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I. INTRODUCTION 


The Panel focused its attention this past year on those areas 
we consider most significant for flight success and safety. Thus 
the Panel focused on the elements required for the Approach and Landing 
Test Program (ALT), the Orbital Plight Test Program (OPT), and those 
management systems and their implementation which directly affect 
safety, reliability and quality control. 

To manage our limited manpower effectively in terms of our priorities, 
we have organized our ten members and consultants into task teams for 
specific areas of ALT and OPT. 

The number of individual fact-finding sessions conducted by the 
individual Panel members and by larger groups within the Panel averages 
four or five a month. Such fact-finding is conducted principally at 
NASA sites and at contractor and subcontractor plants, and as approp- 
riate with other government agencies such as the United States Air 
Force . 

In the process of fact-finding and inspection, the Panel has re- 
viewed considerable detail which is summarized here so the reader can 
understand the data base upon which Volume I is based. This data 
base includes doumentation reviewed in preparation for review as well 
as the questions and answers of the reviews themselves. Because the 
Panel review is on-going, special addendums are incorporated in each 
section to assure the reader has the most update material upon which 
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to evaluate the current posture of the program and its elements. 

The task teams and their objectives are outlined here. 

A. Approach and Landing Test Program (ALT) 

1. Management System for Mission Planning 

The objectives of our reviews in this area is to assess 
the degree to which: 

a. The program management system has defined a set of 
mission rules that provide a reasonable basis for confidence that 
the normal flight plan can be successfully executed. 

b. The flight planning process has used a conservative 
approach in planning the nominal mission and providing for contingency 
and abort situations including emergency separation and jettison. 

2. Management Systems for Certification of the Flight Vehicles 
The objectives of our reviews in this area are to assess the 

degree to which: 

a. Both vehicles are being subjected to a rigorous system 
of reviews to assure they will meet mis.u'*n certification requirements. 

b. There has been a satisfactory program of test and 
analysis to assess the mated configuration in terms of mated aero- 
dynamics, performance and flight controls or to their effect on 
structures and pilot control. 

3. Management System for Certification of the Avionics System » 

Because of the significance of this system, one of our 

4 

members dedicates his efforts to monitoring the development of the 
hardware and software and their integration into a flight system. 
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4. Management System for Facilities, Communications and Ground 
Support Equipment. 

The objective of our review is to assess whether the test 
and simulation program appears to be adequate to demonstrate the 
ability and reliability of each of these elements to support the 
mission requirements. 

5. Management System for Risk Assessment 

The objective of our review is to assess the system for 
the preparation of the ALT Project Mission Safety Assessment Report 
and management's review of the risks being accepted for these flights. 

A second objective is to assess the configuration manage- 
ment system which should assure that the hardware as built is the same 
as the design on which risk assessments are based. 

B. Orbital Flight Test Program (OFT) 

The major elements that are not being tested on ALT are the 
Main Engine, External Tank, Solid Rocket Booster and Orbiter Thermal 
Protection System. Because of the significance of these elements for 
the success and safety of OFT we have dedicated member monitoring and 
evaluating their development and manufacture. 

1. Space Shuttle Main Engine (SSME) 

The dedicated member monitors both component and all-up 
engine development testing and the resolution of specific high-risk 
problems as they arise. The objective of our review is to assure 
that the management system is developing an adequate basis for flight 
certification. The interaction of the engine with the Orbiter, 
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External Tank and Solid Rocket Booster is also considered. 

2. External Tank 

The purpose of the review here is to consider those areas 
that might cause the OFT and operational flights to be below nominal 
expectations. Areas that receive attention include the structural 
adequacy of the tank, the external insulation and its ability to 
support the SSME operation and Orbiter/ET separation. Reviews also 
focus on the tests such as the Main Propulsion Test and Ground Vi- 
bration Test. 

3. Solid Rocket Br'-ster 

Since the objectives of the reviews in this area are to 
assess the reliability of these critical elements, particular attention 
is given to the launch and ascent, structural integrity of the Solid 
Rocket Motor, adequate/reliable performance from the APU's and the 
thrust vector control system. Since these units are subjected to re- 
peated use, the Panel also focuses on the systems for recovery and 
refurbishment . 

4. Orbiter Thermal Protection System (TPS) 

The significance of this new method of protecting vehicles 
during return from earth orbit prompted the Panel to assign this 
area to a dedicated member. The objective of our review is to assure 
that the TPS meets the aero thermodynamic requirements to assure that » 

a safe return is accomplished. This includes an examination of the 

* 

management, test programs, installation and maintenance activities, 
and the interface effects between TPS and other Shuttle elements. 
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II. THE APPROACH AND UNDING TEST PROGRAM 


A. Introduction 

The Approach and Landing Test Project (ALT) is scheduled to 
begin February 18, 1977. It is now scheduled for completion in time 
for the Orbiter to be delivered to MSFC by March 17, 1978 for use in 
the Shuttle vehicle ground vibration test program. 

The purpose of this section of the report is to provide an 
introduction to the management system. This then provides the 
lead-in for the following sections of the report covering the flight 
and ground hardware/software and facilities. 

B. Observations 

1. ALT Documentation and Utilization 

The ALT program is considered a Level III or "project" ele- 
ment of the Shuttle program but it combines the Orbiter, the Shuttle 
Carrier Aircraft and numerous ground facilities and GSE. Therefore, 
a number of Level II requirements must be applied to the management 
and flight associated with the ALT work. Some major items are noted 
below: 

a. "Program Structure and Responsibilities," Volume II, JSC 
07700, October 21, 1976. This document defines the overall program 
in terms of organizational and work breakdown structure and describes 
the responsibilities of the major program participants. All the 
Space Shuttle Program Directives issued by Level II are listed. 

Many of these have a direct bearing on the ALT Program, e.g., (1) 

#1A "Space Shuttle Program Simulation Planning," (2) #21 "Space Shuttle Program 
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Flight Test Program Panel," (3) #66 "Space Shuttle Program ALT Flight 
Techniques Panel" issued June 23, 1976. 

b. "Shuttle Master Verification Plan," Volumes I and II, JSC 
07700- 10-MVP-01 Rev. A. This detailed plan covers the ALT program, 
establishes and documents the approach, requirements and planB for 
verification of the Shuttle system for operational use. 

c. "Flight Test Requirements," Volume I and II, JSC-08943 which 

cover: Volume I - Shuttle Carrier Aircraft, and Volume II - Orbiter 

Approach and Landing. Volume I has the flight test requirements 
necessary for the qualification of the NASA 747 (N905NA) aircraft 

as an air launch platform for the Shuttle Orbiter Approach and Land- 
ing Test program. This volume also includes the verification require- 
ments for the qualification of the 747 as a long-range ferry carrier. 
Volume II has the flight test requirements necessary to verify the 
free- flight subsonic airworthiness of the Orbiter and the pilot-guided 
and an automatic systems approach and landing capability. 

d. "Approach and Landing Test Mission Objectives Document," 

JSC 09918, dated September 30, 1976. This document establishes the 
number and sequence of flight tests to be conducted during the ALT 
program and includes basic objectives and flight test activities for 
each test. 

e. Management of the ALT process and operations is described 
in a system of specific directives and instructions : 

(1) The objectives and scope of Approach and Landing Test 
Program Directives (APD's) can best be described by a quote from APD 
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No. 001 (Rev. 1), dated November 2, 1976. "A system of ALT directives 
is established for providing management direction from the ALT Manager 
to the NASA and contractor elements involved in ALT. APD's and 
Management Instructions (Mi's) will be issued to supersede those parts 
of the ALT Project Management Plan and the Ground Operations Manage- 
ment Plan which no longer apply'. * 

(2) ALT Management Instructions document procedures and 
agreements between two or more ALT elements which have been approved 
by the ALT Manager. They address the operational matters involving 
internal and external organizational interface requirements, the pro- 
cedural requirements in effect, and the duties and responsibilities 
of the organizations involved. Almost sixty (60) have been published. 

2. Tne Flight Techniques Panel (FTP) 

mis Level II operation was established under authority of 
Program Directive No. 66 issued June 23, 1976. mis panel provides 
a forum to coordinate the efforts of those involved in the develop- 
ment of flight techniques for trajectory, attitude control, and 
avionics systems management. The FTP is now a part of Flight Director's Reviews 
One of the more interesting products of this group is a 
set of memoranda called "ALT Flight Technique Briefs", to support the 
development of flight mission rules and the flight data file. These 
widely distributed briefs deal with very specific ALT issues where 
there should be a clear and common understanding among all those in- 
volved on the ALT work or where additional work is requred that must 
be handled in an expeditious manner. Each contains background, 
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specific techniques, and any open issues that may exist at the time, 

ALT Flight Techniques Brief #1 on "APU Consumables Management" is 
described in Table II-I as an example. 

The Panel was particularly interested in such topics as: 

a. Since tailcone-off flight control system limits are loaded 
into the computer memory (called I-load requirements), the Panel 
seeks to assure that the values of I-load are compatible with the 
planned inflight flight control system checks and with the Flight Test 
Requirements . 

b. The degree to which the mated or Orbiter aero data bases should 
be updated between ALT flights is under review. An area of interest is 
the determination of the size of an effort to validate and update a 
selected suoset of parameters or candidate list of parameters, and the 
form in which the data would be required, as well as the minimum turn- 
around time that f.i would take. 

c. The Panel's reviews considere I the methods for ground/ flight 
crew confirmation of separation, mated performance penalty variations 
with atmospheric temperature conditions, the flutter envelope for the 
Orbiter with no hydraulic power restraining the control surfaces, ALT 
weights and c.g.'s. 

3. Flight Profiles 

The individual ALT flights are being meticulously planned 
in every known detail to assure the greatest return while conducting 
the missions under the safest of conditions. An example of the ALT 
mission calculations is shown in the "sample" sheet designated as 
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Table II-H. A sample of the ALT Free Flight Profiles and timelines 
Is shown In Figures XI-1 and 2. 

4, ALT Review System 

The procedures for certifying the flight and ground equip- 
ment and personnel for the ALT missions follows the basic system used 
on prior manned programs. Modifications have been made to meet the 
specific requirements of this flight program. The major review system 
includes the Design Certification and the Flight Readiness Reviews. 

In each case the work goes on for many months and culminates in a 
series of formal "board" meetings at higher and higher levels of 
management. In addition to these certification reviews the Orbiter 
systems have been going through an extensive test program and the 
results have been monitored and evaluated through a series of Customer 
Acceptance Readiness Reviews or Configuration Acceptance Reviews. 

The ALT Design Certification Review ha4 two phases. The 
first phase consisted of a project Center level review in November. 

The second phase provided a report to a senior Space Flight Management 
Board chaired by the Associate Administrator for the Office of Space 
Flight. This was conducted on December 9-10, 1976 at JSC. The early 
February ALT Flight Readiness Review (FRR) will provide management 
another opportunity to assess the readiness of the "as built" hardware/ 
software for the first ALT mission. There will be subsequent FRR' s 
for such major mileetones as the first captive flight (February 1977), 
first manned captive flight (May 1977), first approach and landing 
mission (July 1977), and the first flight with tail-cone off (November 1977). 
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Since all of the review effort is directed toward flight 
readiness, it is worthwhile to indicate what the FRR is expected to 
accomplish in terms of (1) what the FRR should answer, (2) who must 
assess and certify readiness, and (3) the areas of review. 

What the FRR Should Answer 

(1) Has all applicable hardware and software been verified ready 
for the next ALT flight phase? 

(2) What problems have been encountered since the previous re- 
view and what are the remedial actions being taken, and will they 
accomplish the job? 

(3) Are the flight crews and flight control teams ready to con- 
duct the mission from the viewpoint of nominal and possible off-nominal 
conditions? 

(4) Are the ground support teams prepared and ready? 

(5) At the "L-2" (launch day is "L") meeting, what are the re- 
maining actions to be taken prior to actual flight? 

Who Is To Make The Assessment and Certification 

Usually the same organizations that have accomplished the Design 
Certification Review in a two phase review just as the DCR. 

Review Areas 

All those covered by the Design Certification Review plus the 
operational readiness of the flight crews, flight control teams and 
the ground support teams. 

5. NASA Acceptance of Orbiter 101 

As noted before, the ALT missions are scheduled for completion in 
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time to meet the scheduled movement of the Orblter to MSFC for major 
test programs there. Such movement requires a formal NASA acceptance 
decision transferring the vehicle from contractor ownership to NASA 
ownership, the form used Is designated as Form DD-250. The uniqueness 
of the reuse of the Shuttle Orblter leads to a somewhat different 
arrangement than that used on past space programs and la worth noting. 

(1) Rockwell International, the contractor, is responsible for 
the Orblter 101 until the ALT program is completed. Thus' the DD-250 
accepting the Orblter as NASA property will occur at DFRC at the 
and of 1977 or the first month of 1978. 

(2) The Orblter would then be returned to Rockwell International 
as Government Furnished Property (GFP) so that they may accomplish 
those modifications needed to meet the requirements of the MSFC 
test programs (Vibration type teats). 

(3) Upon completion of the MSFC test program the Orblter 101 
will be returned to Palmdale for, as GFP, for modification to the 
operational configuration. This then will be delivered to DFCR for 
delivery to KSC. NASA then accepts the modifications to its GFP. 

(4) On the other hand the Orblter 102, to be used on the OFT 
flights, will be formally accepted by NASA, with proper DD-250 forms, 
when it is ready to leave Palmdale to go to DFRC. It will then be 
transferred to KSC by means of the 747-ferry aircraft. 

This method of control should reduce the paperwork to a minimum 
and allow for more complete and timely configuration icontrol. 

i 


f\ 


11 


1 


TABLE I I- I 

ALT FLIGHT TECHNIQUES BRIEF #1 
APU CONSUMABLES MANAGEMENT 


BACKGROUND 

The baseline APU management plan is designed to keep a minimum of two 
APU's running in the pressurized mode (3000 psia) from takeoff -11 
minutes through rollout, and for all three systems to be in the pressur- 
ized mode for critical periods of mated flight and throughout free flight. 
This keeps fuel consumption at a minimum, while providing sufficient 
safeguards against flutter and thepotential structural problems it can 
produce. Running three systems continuously is the desired mode of oper- 
ation, but current fuel consumption data indicates that this may not 
always be practical. A minimum of two systems will be pressurized at 
all times due to the fast flutter onset following the loss of the last 
hydraulic system in the high pressure mode. Two systems operating in the 
depressurized mode (500-1000 psia) will not be relied upon to prevent 
flutter. While flying with two systems pressurized and one off, the crew 
will respond to a failure of one of the active systems by commanding on. 
the third system. 

\ The time required for the APU to come up to speed and bring its hydraulic 

1 system to full pressure is two to three seconds. Three switches must be 

thrown, the fuel tank valve to open, the hydraulic pump pressure switch to 
i LOW, and the APU control switch to START/RUN for an APU to be brought on- 

line. The APU heater switches will be in auto and the controller power 
switch ON even when an APU is off line. Once the APU has started, the 
hydraulic pump pressure switch will be set to NORMAL. Hot starts ~ ••resent 
r no problem if the catalytic bed is maintained at operating temperati js. 

For real time planning purposes, it should be noted that the APU’s bum 
approximately 2,30 lbm/min or 138 lbm/hr. Each of the three tanks con- 
| tains 295 lbm, including an unusable plus uncertainty of 30.5 lbm. This 

! equates to a run time of approximately 115 minutes for each APU. Since 

there is no crossfeed between the three hydrazine tanks, the APU's must 
be operated alternately to achieve the maximum duration two system capa- 
bility. It must be stressed that these numbers are functions of many 
variables not yet completely determined (i.e., altitude profile, hydraulic 
k pump efficiency) and will be updated as hardware testing and mission 

planning continue. 

Three acceptable techniques have been identified for managing APU fuel. 

Plan A (see enclosure 1) involves switching the three systems on and off 
to approximately balance their operations and cause all three to reach 
- the fuel redline (unusable * uncertainty) at the same time. Plan B 

(enclosure 2) involves depleting system 2 or 3 down to the redline 
(30.5 lbm) level and completing the mission on the remaining system 
(2 or 3) and system 1. Plan B will support a longer mission since the 
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Enclosure 1, Page 2 


maximum return allocation for the depleted system can now be in effect 
distributed between the remaining two systems. Plan C is the straight- 
forward technique of powering up all three systems for the entire mission. 
When the final APU hardware data and mission profiles are acquired, a 
decision will be made as to which plan to use for each flight. Plan C 
is the most preferable approach and Plan A is the second choice. The 
most preferable plan that will support the normal mission duration plus 
a 20-minute contingency will be selected on an individual flight basis. 

SPECIFIC TECHNIQUES 

In Plan A (see enclosure 1) system 1 is left off initially and the longest 
of all three, since it is the most heavily loaded and, therefore, runs 
out of fuel the fastest. It is then alternated with system 2 until 
approximately five minutes prior to pitchover when all three systems are 
turned on. All three systems are left on until the abort maneuver is 
complete or until three minutes after touchdown if a separation is per- 
formed. If an abort is performed, system 3 is turned off after the abort 
pull-up and sequencing continues until five minutes prior to the next 
pitchover. Assuming the enclosure 1 timeline is followed, Plan A as 
described will cause the switching valves to be cycled 16 times during a 
flight. 

Plan B (see enclosure 2) involves depleting system 2 or 3 by running it 
continuously until it reaches the unusable + uncertainty level. The 
other two systems are alternated as necessary to keep their fuel reserve 
balanced and to have all three running for separation attempts and/or 
free flights. The fuel normally brought home in one system is distributed 
between the other two and thus a longer duation is achieved at the cost 
of a slight reduction in failure tolerance. Assuming the enclosure 2 
scheme is followed, the switching valves will be cycled 17 times. 

Using current specific fuel consumption data plans A, B, and C can support 
142, 160 and 105 minute APU missions respectively. Current mission dura- 
tions (APU) vary between 107 and 123 minutes (20-minute reserve included) . 

OPEN ISSUES 


0 Rockwell is studying a potential problem concerning cold 

hydraulic fluid in the lines to the actuators. There is some 
potential that each system will have to be flowed for a period 
of time prior to SCA takeoff and that an APU management plan 
that calls for a system to be powered down in flight would also 
carry a minimum flow cycle requirement to preclude cold spots 
in the loop. 
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TABLE II-II 


SAMPLE A.t.T. MISSION CALCULATION, DOUBLE LAUNCH ATTEMPT 
JT9D-7AH Engines 


TAKEOFF vrr. 

ZERO FUEL VfT. AT LANDING 
CR3 WEIGHT AT LANDING 
FUEL LOAD 
TEMPERATURE 
FIELD CLEVATION 
ORBITER INCIDENCE 


Tailcone On 

558,912 LB 
484,400 LB 
150,000 LB 
73,700 LB 
Standard Day 
2', 300 FT 
6 ° • 



ALTITUDE 


f 

FUEL 

WEIGHT AT 

AT END OF 



MISSION 

BURNED END OF SEGMENT* 

SEGMENT 

TIME 

DIST 

SEGMENT 

(LB) 

(LB) 

(FT) 

(MIN) 

(MM) 

TAKEOFF ALLOWANCE 

3,500 

554,600 

3,800 

21.0 

0 

CLIMB TO 200 FPM 
CEILING 

18,200 

536,400 

25,600 

26.2 

125 

CRUISE 

(IS min C H ,1,8) 

7,500 

. 528,900 

25,600 

15.0 

75 

CLIMB TO 200 FPM 
CEILING 9 SPECIAL 
RATING 

5,100 

523,800 

28,000 

8.3 

40 

LAUNCH ATTEMPT 

500 

. 523,300 

19,000 

2.0 

10 

CLIMB TO 200 
FPM CEILING 

8,800 

514,500 

26,600 

15.0 

70 

CRUISE (IS min @ 
M .48) 

7,000 

507,500 

26,600 

15.0 

75 

CLIMB TO 200 FPM 
CEILING @ SPECIAL 
RATING 

4,800 

502,700 

29,200 

CO 

• 

45 

LAUNCH ATTEMPT 

500 

502,200 

19,000 

2.0 

10 

DESCENT 

700 

501 ,500 

2,300 

6.3 

30 

TOTALS 

56,600 



119.2 

O 

CO 

RESERVES 






1/2 HR HOLD 

13,400 

488,100 




52 of INITIAL FUEL 

3.700 

484,400 




* EXCLUDES ORBITER 

CONSUMABLES 

OF 812 LB WHICH ARE INCLUDED IN 

TAKEOFF 


WEIGHT ONLY. 
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ALT FREE FLIGHT 1 



FIGURE II-l 












ALT FREE FLIGHT 6 



FIGURE II- 














III. ORBITER 101 


A. Introduction 

The first flight Orbiter (101) has been subjected to a manage- 
ment review process as systematic as the ones on prior manned flight 
programs. The progress of the design has been critiqued through a 
system including a Preliminary Requirements Review (PRR), a Preliminary 
Design Review (PDR), Critical Design Review (CDR) for all major subassemblies 
and finally the Design Certification Review (DCR) . The progress of the 
flight hardware and software through the verification test program 
has been monitored and critiqued through a series of Customer Accep- 
tance Reviews. 

B. Observations 

1. General 

This section of the report discusses the Orbiter systems. As 
for the interface definition and separation monitor and control system 
this is shown in Figure III-l and the mechanical system is shown in 
Figure III-2. These interfaces and the electromagnetic compatibility 
and various hardware/software interfaces received verification by 
analysis, and varying levels of actual equipment testing. Mostly 
this verification testing was done at the system level 

2. Structures 

The internal program reviews and printed material have provided 
the Panel ample opportunity to review the structures in terms of 
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design requirements and verification as well as material control. 

The Panel has given particular attention to open work and areas o£ 
concern that need to be resolved before the ALT flights. 

Briefly the structural design requirements cover the following 
areas : 

a. Ultimate factor of safety of 1.4. 

b. No skin buckling prior to entry. (OFT requirement) 

c. Fracture mechancis considerations. 

d. 65,000 pound payload up and 32,000 pound payload down. (OFT) 

e. 350° F. maximum external skin temperature. (OFT) 

f. Landing sink speeds. 

g» Acoustic environments. (OFT) 

There has been little difficulty in meeting these requirements 
except in the area of landing sink speeds and to a lesser degree the 
acoustic environments. These areas have received appropriate program 
attention during the design and test program. The landing sink speed 
has been specified at no greater than 9.6 feet per second with a 32K 
payload, and there is a requirement of 6.0 feet per second when the Orbiter has 
an abort landing with a 65K payload. The acoustic environment speci- 
fication is 150-165dB to meet payload requirements. 

Certification of dynamics requirements by analysis (SD 75-SH-0032-1) 
are supported by horizontal ground vibration tests conducted with the 
Orbiter 101. Such tests have shown minor deficiencies in the mathe- 
matical model used in the analysis. Corrections to this model are 
now in process and should be completed by mid- January 1977. A rerun 
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of the analyses can then be made, particularly with regard to flight 
control stability, flutter stability and loads. 

There are a number of items in the process of being closed in 
the area of material control certification. The following items are 
to be completed: materials teats at White Sands Test Facility, appro- 

val of subcontractor material control plans and use, single-barrier 
failure analysis, review of closeout photos, material usage agreements 
for the off-the-shelf hardware, ground support equipment hazardous 
fluid review and the insertion of all materials data into the MATCO 
system. 

Other items in the process of being resolved include: 

a* Proof load test of nose landing gear door. 

b. Five open RID's on the Tail Cone. 

c. Tests to assess whether the Thermal Protection System on the 
vertical stabilizer and the Auxiliary Power System pod must be re- 
designed because of a possible increase in temperatures from 
exhaust products. 

d. Certification tests on the Orbiter purge, vent, and drain 
components. These are small items such as clamps, screens, adapters, 
etc. 

While the elevon seal panels have been a problem, the current work 
indicates these have been satisfactorily resolved. Finally, there is 
a large amount of work deferred from the Palmdale plant that will 
need to be finished at DFRC. 

Orbiter 101 will carry the following development flight instru- 
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> mentation to gather data on structural response to flight conditions: 

Quantity Type Purpose 

216 Strain Gauge Primary Structure Response 

74 Accelerometer Structural Dynamics, Flutter 

3 Microphone Structural Dynamics 

4 Differential Pressure Flutter 

3. Auxiliary Power Plant and Propulsion Simulation 
The main propulsion system and the orbital maneuvering system 

and reaction control system are all simulated or modeled with inactive 
equipment. For instance the three main engines are simulated as to 
mass and envelope. There are stiff braces in lieu of thrust vector 
control actuators as well as simulated engine -mounted heat shields. 

The forward reaction control system is a boiler-plate module without 
any actual or simulated subsystem hardware. The Orbital maneuvering 
system and reaction control system pol contains a simulated structure 
to achieve the proper aerodynamic moldline, and no system hardware is 
required . 

The Auxiliary Power Unit Subsystem (APU) consists of three inde- 
pendent systems that provide mechanical shaft power to the hydraulic 
pumps, using one pump for each APU. Each APU system consists of a 
fuel tank, fuel distribution and servicing system, auxiliary power 
unit and controller, lubrication system, exhaust duct assembly, fuel/lube 
oil vents and drains, and a thermal control subsystem. The fuel used 
is monopropellant hydrazine. The pressurizing gas is helium. There 
are displays and controls and sensing devices to permit the crew and 
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ground-based stations to monitor the operation of the overall and 
specific segments of the APU system. The power output to each hydraulic 
pump is 135 HP normal speed and 148 hp at maximum speed. Normal speed 
for the turbine is about 73,000 rpm. The APU operation during manned 
captive flight is as shown in Figure III-3, and for free flight in 
Figure III-4. Note that in each case the APU's are required to be 
shut down and restarted during the flight period. Three significant 
problems have to be resolved. 

a. Shutdown Soak- Back Temperature. This appears to be caused 
by the fuel control valve response which permits burning of fuel in 
the exhaust area. There are several investigations in process. These 
include consideration of injector /standoff changes to reduce peak 
temperature and an assessment of the fire hazard with insulation re- 
moved and the use of a shield to allow convective cooling. 

b. Low Fuel Pump Volumetric Efficiency. The bearing design and/or 
material causes this loss in efficiency thereby limiting peak APU horse- 
power. It is a time-dependent problem which means that the APU will 
work well for awhile and then have a drop off in efficiency. Investi- 
gation revealed that the raphitar (carbon with binder) material 

used for the bearing have less swell than development bearings con- 
tributing to large clearance and greater loads. Other graphitar 
materials swell too much and cause the bearings to seize. The approach 
for ALT is to machine a new bearing and match their geometry and tol- 
erances to the "swell" characteristics of the machine. As for the 
long term solution, a more extensive test program is planned which 
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will Include consideration o£ other materials. 

c. Turbine Wheel Life. There has been a failure of an APU 
wheel at just under 60 hours of operation. Analysis of the failure 
showed that the electron beam welding machine failed to mal- the 
necessary penetration. The wheel design and manufacturing procedures 
are being changed to improve producability and non-destructive test 
procedures are being added. These problems may impact delivery 
schedules for the necessary APU's for the integrated test program. 

There is, of course, a means of conducting the integrated tests with- 
out the APU's, but this is not desirable. 

4. Avionics. 

The Orbiter 101 avionics provides the flight control and automatic flight 
ALT free flights as well as to support manual operations, 
management of the Orbiter systems, and determination of vehicle status 
and operational readiness. The avionics system consists of the flight 
control and data management subsystems on which the Panel focuses. 

In addition, there are the subsystems for guidance, navigation and 
control, crew station displays and controls, communications and 
tracking, electrical power and the flight instrumentation. The struc- 
ture of the Orbiter 101 software is shown in Figure TIIn5. Verifi- 
cation of the avionics hardware and software is accomplished through 
a program of reviews, analyses and tests shown in Table III-l. The 
following sections briefly describe each subsystem, 
a. Flight Control Subsystem FCS. 

This system consists of sensors and controls providing in- 
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puts to the computer system which drive the vehicle effectors (actuators) 
and conditions the actuator command signals to assure that there is 
effective control and stabilization of the vehicle. This primary system 
is designed to meet the following safety criteria: 

Level 1. Capability to complete nominal mission after one 
failure with normal system performance. 

Level 2. Capability to return safely after a second failure 
and limited operation outside of design boundaries. 

The hardware for this system includes what are called line 
repla .table units (LRii's), the crew controls, sensors, control system 
software, and the actuation subystem. 

The software for this system is identified in terms of soft- 
ware programs for specific phases of the test and flight program. 

1. The yu-101 (0PS4) program was used for early confidence 
testing of the FCS and support to the test program for the LRU's 
installed in the vehicle as well as the Horizontal Ground Vibration 
Tests. 

2. The ADL5B (first OPS 2 delivery) is to be used for all single 
string testing. 

3. The ADL 5 is to be used for multistring testing including 
verification of the FCS. 

4. The SAIL dropout program is a preliminary or interim version (fit S/W) 
for use at the Shuttle Avionics Integration Lab in testing to support 

the free flight missions of the Orbiter during ALT. 

5. The ALT Cl is the vexsian to be used on the ALT flights. 

The Panel has given particular attention to the program to certify 
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the software flightworthy and Ifight ready. An important part of the 
vorification program is tho "Acceptable Fault Tolerance Verification" 
phase, This part of the program demonstrates the ability of the system 
to detect failures and protect against false alarms, and demonstrates 
acceptable level of vehicle transients due to system failures. The 
subsystem stability and performance and redundancy management certification 
tests will bo conducted on ADL/FCUL. Tho testing of this program provides 
important information on the crow's inter-action with tho system that helps 
plan the timeline for redundancy management, 

A good deal of work in the certification program remains to bo 
completed at tho time of this report. Much of it is to bo done as part 
of tho integration tosting on Orbitor 101 as well as ADL, SAIL system tests 
and qualification tests on certain of tho LRU's. Manned and automatic 
closed loop flight simulations are planned for ADL and SAIL as a major 
part of tho flight control vorification program, 
b. Data Processing 

This subsystem comprises tho major processing elements for compu- 
tation and control and interface linkage. This includes: (1) computers for 
handling tho sensor inputs and performing tho computations for control, 
guidance, navigation and data management functions, (2) magnetic tape memories 
for large volume bulk storage and organisational information related to 
individual display presentations, (3) digital data buses to accommodate 
the data traffic betweon computers and the other Orbitor subsystems, (4) 
remote interface units to convert and format data at various interfacing 
subsystems, and (5) display unites to monitor and control the orbitor and 
its mission by presentation, insertion or change of selected variables. 
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These elements of the data processing system are configured in redundant 
quantities mainly because of the overall avionics fault tolerance, par- 
titioning, and functional isolation constraints. Ono of the major components 
of this system are the Multiplexer/Demultiplexers (MDM) which aro used in 
numerous remote locations of the orbiter to handle the functions of serial 
data time multiplexing and demultiplexing associated with the digital data 
buses, and of the interface signal adaptation. Those units are multi- 
purpose bus terminals which provide compatible interfaces between the 
Input/Output Processors and various interfacing subsystems. All data 
transfer operations of the MDM are initiated and controlled by the 
Input/Output Processors. 

There are a number of problems that are being worked at this time: 

(1) The display unit has had a corona problem. The high voltage power 
supply has an arc path which could cause the display unit to fail. The 
interim fix for the Orbiter 101 is a corona shield made of Kapton tape. The 
effectiveness of this fix has been demonstrated by analysis and test at the 
vendor’ 8 facility. During test at higher temperatures (78C vs 50G) the unit 
ran for 1142 hours before failing. At the nominal temperature of 50°C this 
translates into an expected 2000 hour life. Final changes are planned for 
the unit. 

(2) The MDM has had difficulties passing the vibration portion of the 
qualification tests. The vibration levels used are those for Orbiter 102. 
However, since the Orbiter 101 ALT environment is considerably more benign 
than that for the Orbiter 102 there is no expected problem during ALT flights. 
The final solution required for Shuttle operational flights is to pot the 
power supply with foam and rerun qualification. In another area of the 
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MDM the sequencer/sequential control unit (SCU) has had "halts" in which 
the MDM ceases to operate on one data bus until power is recycled. The 
work-around is to switch to the backup data bus. One potential contributor 
to the problem was a manufacturing error which resulted in some MDM's having 
a 5K ohm resistor in the sequence control logic. All critical MDM's have 
been corrected. Although this has a very low frequency of occurance it will 
be monitored closely during the integrated tests to assure that it is 
acceptable for ALT missions. 

(3) A power supply failure in the central processing unit of the 
general purpose computer has been caused by internal shorts. The short 
current was sufficient to cause severe charring of components inside the 
unit (power supply) and the loss of the general purpose computer. The 
problem is under intensive investigation at this time including failure 
analjjis, but the problem still is open for positive identification of th cause. 

c. Integrated Guidance, Navigation and Control (GN&C) 

The GN&C system is, of course, critical to the operation of the flight 
control system. The requirements for this system are depicted in 
Figure III-6 and the remaining activities to get the system ready for ALT 
are shown in Table III- II. 

d. Displays and Controls 

This subsystem includes the integrated arrangements of functions 
dedicated and general purpose display units, switches, meters, status 
indications, cathode ray tubes and associated keyboards and encoding-decoding- 

conversion electronics associated with interfacing instruments and manual 
controllers. It also includes the interior and integral lighting and 

the very important caution and warning subsystem. The caution 
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and warning setup provides the crew with timely alerts about actual or 
potential orbiter system failures or out-of- tolerance conditions. A 
memory is provided in this arrangement so that the crew may determine 
whether preselected system annunciator lights have been energized 
previously. 

Problem areas, which are in the process of being resolved, include: 

(1) The driver display unit development tests indicate that 
the radiated electromagnetic interference may be out of specification 
by as much as 24 dB at certain frequencies. This radiation level would 
still be about 20dB below that specified as the susceptibility thres- 
hold for Line Replaceable Units (electronic boxes). The capability 

for proper mission performance will be verified during the integration testing 
in progress on SAIL/ADL and the Orbiter, and does not appear to pose 
undue problems for flight at this time. 

(2) The altitude vertical velocity indicator did not meet 
electrical susceptibility requirement. It was about 17 dB below 
specified level at the one frequency of 7.4 KHz and this might affect 
the buses and possibly cause both altitude verticle velocity meters 

to malfunction. This will also be re-examined during integrated system 
test andSAILand does not appear to pose a problem for orbiter active 
flights at this time. 

Here again there are a number of final reports that are due in 
the January- to-March time frame to complete the certification program. 

e. Communication and Tracking 

This system consists of the radio frequency processing and dis- 
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tribution equipment necessary for (1) reception, transmission and 
distribution of Orbiter and ground-originated voice, (2) transmission 
of operational and DFI Pulse Code Modulated intelligence, (3) Shuttle 
Carrier Aircraft relay of S-band PCM data, (4) TACAN navigational aids, 

(5) radar altitude, (6) microwave scanning beam landing system(MSBLS) , (7)C-band 
beacon. TACAN is usable throughout both captive andfree flight. MSBLS 
is usable only during the straight-in-portion of the approach. The 
radar altimeter provides useful data following separation at altitudes 
less than 5,000 feet and the 747 FM relay transceiver relays orbiter 
PCM data during mated flight through separation. 

There appear to be no concerns regarding this subsystem at the 
time of this report. 

f. Electrical Power Distribution and Controls 

This electrical power distribution and control system 
converts DC power to AC power and distributes AC and DC power 

all vehicle elements. Based on the verification program, the elec- 
trical power system appears to be in good shape with no single failure 
points that would lead directly to loss of the vehicle. There are 
about eleven (11) certification activities on the electrical subsystem 
that ha^e to be completed in January and February 1977. These are 
a constrain on the inert Orbiter 101 flights and are expected to be 
completed prior to active Oi*biter flights. 

g. Instrumentation 

There are two types of instrumentation systems - development 
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flights instrumentation (DPI) and Operational Instrumentation (01). 

The DFI will be removed after the development phase of the program. 

The functions of the DPI are essentially the same as those of the 01, 
except that the emphasis is on acquisition of information for use in 
evaluating the Orbiter 101 performance. Instrument location and types 
are shown schematically in Figure III- 7 

Development activities for the instrumentation subsystem include 
both testing and analysis. With the exception of off-the-shelf equip- 
ment, the development activities began at supplier facilities. The 
objective for suppliers was to establish confidence that the equipment 
design will satisfy mission requirements over all combinations of 
operational environments. For off-the-shelf equipment, design con- 
fidence has been established by showing that the equipment has pre- 
viously been demonstrated to meet criteria that are equivalent to or 
more stringent than operational requirements. 

5. Backup Flight Control System (BFCS) . 

The BFCS is functionally separate from the primary Orbiter avionics 
system to provide an alternative means of control in case of a "sur- 
prise" or generic problem in the multisLring system. It is, there- 
fore, a simple single string system. To achieve independence between 
the primary and backup systems, the software implementation of these 
control laws in the BFCS was done separately from the software imple- 
mentation in the primary FCS. and is operated in a separate computer from 
the four primary computers. The software implementation is a simple design 
and is an adaptation of the control laws of the primary system. The 
operational flight program is mechanized in a straight-line fashion 
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with a very simple executive function. All functions except the dis- 
play and pulse code modulation (PCM) outputs are scheduled at a 
single interation rate and in a fixed sequence. As each function is 
executed, operation is returned to the executive function. The functions 
used are: executive, flight control, displays and controls, telemetering, 

fault detection, error handling, input/output, housekeeping, and ground 
support. 

The system has a separate dedicated computer,, since this is a single 
string backup system using a simple program. The program has accepted single 
failure points that coula cause loss of vehicle. However, this system will 
only be engaged if there are cacastrophic software failures in primary system. 
The only function other than flight control performed by the BFCS is 

the collection, display and formating of air data computer parameters 

for the down-link data transmission system. 

Two modes are available with the BFCS. The primary mode of 
operation is the command augmentation system (CAS) with an emergency 
manual direct mode. The CAS mode contains a down-mode capability in the 
event of a detected air data computer failure . 

Assessment of the performance capability and design maturity of 
the BFCS is being accomplished through the following test program: 

(1) Development tests. The Charles Stark Draper Laboratory 
(MIT) conducted development tests on the BFCS operational flight pro- 
gram to evaluate each module with all branches and end-to-end unit 
tests for each function. Dynamic tests were conducted to evaluate 
closed-loop performance of the BFCS digital autopilot and functional 
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capability in an F-8 Navy fighter with Shuttle dynamics. Rl/SD con- 
ducted design verification teBts in the Avionics Development Lab- 
oratory to evaluate software coding, linkages, support functions and 
end-to-end verification. They also conducted software interface and 
compatibility tests with line replaceable units and a single-string 
subsystem as well as a closed-loop test to verify subsystem operation 
and capability. 

(2) Verification tests. JSC and RI conducted software verifi- 
cation tests in the SAIL. This was followed first by subsystem inte- 
gration tests to verify design compatibility between software and hard- 
ware and then by closed-loop tests to verify their operational com- 
patibility. The subsystem verification tests are now in process. 

(3) Acceptance tests. The tests conducted at Palmdale checked 
out the subsystem copper (hard-line) path. Single-string closed-loop 
tests verified low gain with the air data computer off. Delta test- 
ing is in process at the time this section is written. It is to verify 
single-string closed-loop with the air data computer on. Integrated 
tests are to verify parallel system compatibility and limited ALT 
mission objectives because of static environments. The remaining 
activities associated with the BFCS include the performance of rollout 
simulation, complete bending compensation, reverification of the BFCS 
software in the SAIL, an update of the supporting documentation and 

a complete system verification in SAIL. The system will then be re- 
viewed and accepted at a Customer (Configuration) Acceptance Review 
Board in May 1977. 
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6. Orbiter Crew Station. 


Since the crew display and controls and caution and warning sub- 
system are described under the avionics section, this section will 
focus on two crew safety subsystem. The crew escape subsystem is to 
enable the crew to escape at any time throughout the entire profile 
of the ALT program. It also will permit the crew to escape during 
the ascent phase of OFT up to an altitude of 75,000 feet and a 
velocity of Mach 2.7. The subsystem also provides for crew 
escape on the pad, except where a fireball occurs. 

There are two side-by-side rocket propelled seats. The ejection 
seat system is a modified Lockheed F-12 system. Above the seats are 
an inner and outer panel which are jettisoned by pyrotechnic devices. 

The inner panel is part of the crew module overhead integral structure, 
while the outer panel is part of the forward fuselage integral structure. 

Figure III- 8 shows the escape events, and Table III-TII shows 

further detail on the sequence of events. The status of this system 

is as follows: (Production orbiters, 103 and subs do not have ejection 

systems) 

a. The ejection panel severence system, Figure III-9 has 
an oversize cavity between the detonating charge and the panel. To 
eliminate the problems induced by excess cavity volume all production 
panels will be filled withRTV silicone rubber. 

b. One-way transfer devices, which prevent seat ejection 
during emergency ground egress or rescue ingress, did not function 
properly and are being replaced with a previously qualified device 
from supplier. 
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Emergency ground egress for the Orbiter 101 is through the side 
hatch, utilizing a hatch-mounted deployable boom, "sky genie" descent 
devices which provide a controlled rate of descent, and safety tethers. 
An alternate egress procedure is provided by jettisoning the over- 
head ejection panels (see previous section) and using similar egress 
equipment stowed on the flight deck. Figure Ilt-lOshows the primary 
egress method. The ground egress boom installation and descent de- 
vices verification tests and analysis report are scheduled for the 
last week of February 1977. 

7. Environmental Control and Life Support and Power System. 

The Environmental system includes the atmospheric revitalization 
subsystem, life support functions, and the active thermal control 
system. The life support functions include the water storage and 
smoke detection and suppression. The fire detection and suppression 
subsystem is required to detect smoke in the avionics bays and the 
crew compartment. Portable fire extinguishers are required for each 
avionics bay and can be actuated from the flight deck. 

The major "open" items at this time include the verification 
analysis, scheduled for completion by February 1977 and the certifi- 
cation completion by March 1977. 

The electrical power generation subsystem consists of three fuel 
cells, each rated at 7KW continuous maximum and 12KW peak power. Two 
fuel cells are required to provide 4.0 to 14 KW of continuous power 
as well as 24 KW of peak power in case one fails and the other has 
to handle the total demand. There is no requirement at this time for 
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storage batteries to be placed on board the Qrbiter, although this 
can be done if it is deemed necessary. The electrical power generation 
subsystem and certification tests are expected to be complete by 
January 1977. 

The high pressure gas storage system for the ALT provides hydrogen 
and oxygen fuel cell reactants. The pressure ranges are: 


Hydrogen 


Oxygen 


Storage, primary 

secondary 

Regulated, primary 

secondary 


2400-250 psig 
2400-200 psig 

350 psig 
200 psig 


2200-900 psig 
2200-800 psig 

900 psig 
800 psig 


8 . Mechanical Sys terns . 

Mechanical systems include the following: (a) hydraulics, (b) 

actuation mechanisms and surface control, (c) separation systems, 

(d) landing/deceleration, and (e) payload bay doors mechanism. These 
are shown in the schematics or outlines shown in Figures III- 11, -12 
and 13 v 


Since the payload doors will not be in use during the ALT flights 
the Panel has focused on the other areas, 
a. Hydraulic Subsystem. 

The Orbiter hydraulic subsystem consists of three independent 
hydraulic power systems with main pumps driven by independent APU's. 

The design and installation of the subsystem are in accordance with 
MIL-H-5440F, Type II, Class 3000 system, amended by SCN 01-0218 

to the Orbiter Contract End Item Specification. The fluid distri- 
bution system utilizes titanium tubing and swagged fittings. MIL-H-83282 
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hydraulic fluid is used in the system as the working fluid. 

The principal development and qualification problems and their 


resolution at the time this section is written are: 


a. Leak failure occurred on the 
elevon actuator crossover joint 
quill seal during development 
tests. There was a non-standard 
seal design combined with a 
large misalignment. 

b. Structural failure of the main 
puap front housing (case) in the 
fillet area where attach flange 
and housing meet. 


c. Filter module shutoff valve 
failure due to broken valve spring. 

Line resonance has not been found to be a problem but the means of 
verifying this is a problem. 

The aerosurface actuators that are to be used in FCHL as part of 
testing will be the same configuration as the flight actuators except for 
the seals. The actuators to be used in qualification certification test 
will be the same configuration including the seals. Functional certi- 
fication testing for the hydraulic subsystem is to be completed in 
March 1977. Since that system will not have the Phase IX modifications, 
further certification testing is required on the system when those 
modifications have been made. This delta certification testing is 
scheduled to be completed by May 1977. 
b. Actuation Mechanisms 


Stepped the quill seal to reduce ex- 
trusion gap (opening of the circumference). 
Also provided wider seal and backup barrier 
seal. The modified quill successfully 
passed 102,000 cycle pressure-impulse tests. 


Failure analysis concluded failure was 
caused by improper impulse test circuit 
setup and improper test circuit relief 
valve setting. Pump housing does meet 
requirements . 

Redesigned the valve to eliminate spring. 


Aerodynamic control surface movement is effected by hydraulically 

powereed actuators that position the elevons and by hydraulically powered 
drive units that position the body flap and combination rudder-speed 
brake through geared rotary actuators. Three redundant 3,000 psi 
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systems supply the necessary hydraulic power. 

The elevon actuator or setvo*ctuator is single balanced using 
two switching valves tied to the three hydraulic systems and is 
commanded by four independent avionic signals. Failure detection 
through servo valve delta pressure and piston delta pressure are 
used by the avionics system to detect failures and provide stable 
actuator operation. 

Three problems can be noted: 

a. The elevon actuator switching valve requires excessive time 
to switch to second standby system. The "trigger" valve was rede- 
signed and successfully tested. Qualification and flight hardware 
are being retrofitted to the Phase II configuration with the 
design fix. 

b. Significant leakage at the unrestrained end of the return 
transfer tube of actuator is due to failure of retaining pins and 
transfer tube displacement. A failure analysis was made and a 
design change approved. The retention device has been redesigned 
and successfully tested, and this retention device will be 
installed during the Phase II retrofit period. 

c. Testing continues at the Flight Control Hydraulic Laboratory 
to understand and correct the actuator/^light control instability at 
16 Hz. 

Other major known problem areas are: (a) the pitting of the body 

flap outboard gear teeth due to improper masking fro the acid etch bath. 
Gears have been replaced with non-pitted teeth. 
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(b) rudder/speed brake motor shaft failure caused by improper 
test setup and procedures, since corrected and now being implemented at 
the Flight Control Hydraulic Laboratory at Rockwell/Space Division, 
and (c) Rudder/Speed Brake seal leakage and Delta-Pressure transducer 
strut failure corrected by redesign at Palmdale. 

c. Separation Subsystem. 

The separation subsystem provides the capability to release the 
Orbiter from the 747 carrier aircraft. This is effected by a dual 
frangible bolt at the forward attach point and by three frangible 
bolts on each of the two aft attach points. The pyrotechnically 
operated frangible bolt design is the same for all three attach points 
and is designed to separate at a predetermined section, and each uses 
two cartridges, each of which is capable of causing bolt separation. 

The certification summary is shown in Table IIT-IV. There are problems 
in certifying the flight hardware. Separation of the electrical um- 
bilical connectors is accomplished by pull-apart connectors subsequent 
to the structural separation using relative separation motion to do 
this. Load sensors at each of the structural attachment interfaces 
provide the measurement of the relative loads between the orbiter 
and the 747 during all mated phases of the ALT missions. 

Additional loads data are obtained to determine the entire flight 
and ground regime load envelope. 

(d) Landing and Deceleration. 

The major open items at this time include: (a) the need for 
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main gear shimmy datnpling (to be determined from Bendix stability 
tests which are scheduled to be completed by January 1977), (b) com- 
pletion of the tire certification for long landing roll (teat scheduled 
for January 1977), and (c) off-limit testing of the brakes at 1500 
psi pressure (scheduled for completion by end of February 1977). 

Program safety personnel have stipulated tests that should be carried 
out before the system can be fully certified. 
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TA3LE IXI-I 

VERIFICATION OF AVIONICS SUBSYSTEMS 


























TABLE III-II 

INTEGRATED GUIDANCE, NAVIGATION, AND CONTROL 
SUMMARY OF REMAINING CERTIFICATION ACTIVITY 
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TABLE Ill-Ill 

Crew Escape System - Sequence of Event* 


TIME (sec)* 


0.0 


0.3 


0.55 

0.75 

1.0 


1.7 


1.9 


2.0 


3.4 


10.3 

At 15,000 feet 


Below 15,000 Feet Above 15,000 Feet 


D-ring pulled, panel jettisons, Same 

power shoulder reel retracts, 
foot actuator retracts. 


Catapult ignition Same 
Drogue gun deploys drogue chute Same 
Drogue chute full-open Same 
Rocket burns out Same 


Separation, lap-belt releases, Separation iniators armed 
shoulder straps cut, foot cables but are blocked by 
cut, D-ring cable cut, separator aneroid device, 
actuates 


Drogue gun deploys main 
parachute 

Upper drogue chute risers cut 
Main parachute full open 
Lower drogue chute risers cut 


Lower drogue chute risers 
cut 

Aneroid unblocks, 
initiating complete separ- 
ation sequence, deploying 
main parachute 0.2 second 
later, and cutting upper 
drogue chute after 0,3 sec 


* Times shown are for the right-hand seat, all events for the 
left-hand seat occur 0.50 seconds later 
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FIG'JRE IXI-2 

MECHANICAL SEPARATION SYSTEM 









APU/HYD ALT OPERATION 
MANNED CAPTIVE FLIGHT 



TIME, (MINUTES) 
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GN&C SYSTEM REQUIREMENTS 

FIGURE III- 6 



• REDUNDANCY MANAGEMENT 




FIGURE III- 7 SOFTWARE STRUCTURE 
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DOOR OPEN/CLOSE MECHANISM 


DCR OV 101 ALT 




IV. SHUTTLE CARRIER AIRCRAFT, 747 


A. Introduction 

The basic 747 Model 123 aircraft was qualified in 1970 by FAA 
certification. Rockwell, the prime contractor, procured the services 
of the 747 manufacturer, The Boeing Company, to modify the vehicle to meet 
Shuttle requirements as an ALT carrier aircraft and as a ferry vehicle. 
Flight tests initiated on December 2, 1976 are currently being com- 
pleted. Delivery to the DFRC site was made on January 14, 1977 
in preparation for the first captive flight of the Orbiter set for 
February 18 , 1977. 

B. Observations 

1. ALT requirements /General and Specific. 

The key technical requirements are in six areas: orbiter 
weights, stability and control, handling qualities, structures, en- 
vironment and modification criteria. In addition, there are specifi- 
cations for such things as the separation clearances after orbiter 
release, communications, and interfaces with ground facilities for 
mating purposes. Table IV-I provides a brief overview of the require- 
ments of principal interest. The separation requirements are de- 
picted in Figure IV-1 and the communications In Figure IV-2. 

2. Airplane Modifications 

The modifications required to meet the ALT and Ferry require- 
ments fall into two categories: (1) permanent modifications and (2) 

removable modifications. These modifications are shown in Figures IV-3 

and IV-4. Permanent modifications are those made to the basic structure 
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and subsystems that remain with the airplane. These modifications 
certifiable by the FAA and are of a nature that the airplane con- 
figuration could be type-certificated for commercial use if required. 

The airplane presently is designed as a "Public Aircraft" and does 
not require FAA certification. Removable modifications have been 
made to the structure and subsystems in what is commonly called "kit" 
form. Design definition and verification of these modifications were 
obtained through a comprehensive analytical and test program which 
is described later on. 

3. Design Verification 

This work was accomplished through (a) utilization of the 
extensive commercial airplane data base available, (b) analysis wherever 
possible, and (c) the extensive use of wind-tunnel testing to support 
analyses. For those permanently installed modifications, FAA criteria 
and participation were used. Because the program is basing its needs 
on flight-proven concepts and qualified hardware components there was 
no developmental hardware, no qualification tests, and the final veri- 
fication was accomplished at the system-level. 

Qualification tests on orbiter interfacing hardware and 
government furnished equipment (GFE) were performed where required 
based on the use of common aircraft and shuttle orbiter designs and 
qualified hardware. 

The wind tunnel testing was accomplished in the following 
phases: (1) Configuration Development Tests to define or refine the 

external geometry of the modifications, (2) Design Verification 
tests to verify thi-t the design of the modifications and the mated 
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SCA/Orbiter configurations will be satisfactory for the performance 
of the ALT missions, and (3) Design Data tests to provide data re- 
quired for detail design analysis of flight characteristics, per- 
formance, control capability, airloads, and flutter boundaries. The 
tests were planned to obtain lata for the SCA alone, and for the 
mated configuration for ALT flights. Air launch aerodynamics data 
were obtained from a combination of SCA-alone data and proximity 
effects data. A total of 3470 occupancy-hours of wind tunnel test- 
ing was completed using models ranging from 0.03-scale to 0.046-scale 
for high and low speed work respectively. 

Aerodynamic characteristics were developed for those 747 and the 
mated configurations pertinent to the ALT program. These characteristics 
formed the basis of the performance analysis- determination of flying 
qualities which included detailed pilot simulation studies, and evalu- 
ation of failure cases. Analyses were conducted to determine recommen- 
dations for the optimum launch sequence. 

Stability and control analyses were also conducted using the 
basic aerodynamic characteristics. Primary and automatic flight 
control system detail design requirements were defined. Flying qual- 
ities were determined both analytically and by piloted simulation. 

Manual and autopilot performances under normal and failure conditions 
were verified by 1200 hours of simulation usage. 

Flutter analyses were accomplished to verify that the 747 final 
design is essentially flutter free up to 1.2 Vp which is equivalent 
to 1.44 times the dynamic pressure. V D is the Design Maximum Velocity, 
indicated airspeed in knots. Wind tunnel tests indicate a minimum 
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margin of about 2.0 V D . The mated flutter analysis work should be 
concluded in January 1977 and the verification work on coupled modes 
should be finished prior to the first mated flight in February. 

The 747 structural design loads were developed based on the FAA 
FAR 25 requirements "Airworthiness Standards, Transport Category," 
except as modified to allow safe and efficient operation of the basic 
airplane during orbiter ALT flights. 

Systems tests consisted mainly of the vehicle/system functional 
checkout and acceptance tests, major ground tests, and flight tests. 
Vehicle/system functional checkout and acceptance tests verified form 
and fit for all removable structure as well as subsystem end-to-end 
operability and performance. The major ground tests performed in- 
cluded a ground vibration test or modal survey and an electromagnetic 
compatibility test. Flight tests currently in progress will complete 
the verification testing prior to mating with the orbiter for ALT 
and will demonstrate airworthiness of the 747. Principal test ob- 
jectives include checks on flutter, stability and control in both 
the manual and the automatic flight control modes, performance, loads 
and buffet . 

4, Major Areas of Concern 

To assure safety of flight and successful ALT missions 
the following items are to be followed in detail. 

The buffet effect of the orbiter (tailcone-off) on the aft 

sections of the 747 may limit the crew capability because of excessive 747 
cockpit vibration. Tailcone-on flight (the greatest number) do not present 
a concern due to buffet. The 747 crew must have absolute control over the 
aerodynamic controls and displays at the time of separation of the orbiter 
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from the 747 to assure proper and safe operation. Currant calculations, 
based on available data, indicate that the 747 structure fatigue life is 
about 50 hours of mated flight (Tailcone-off) particularly in aft sections 
of the 747. Flying qualitites are expected to be somewhat degraded due 
to the mated conditions. 

To meet these concerns a number of steps are being taken, including: 

a. Instrumentation is installed to monitor loads and stresses. 

b. Critical structure is inspectable and relatively short flights 
are to be followed by inspections. 

c. Incremental flight test program allows gradual expansion of the 
flight envelope and permits a greater understanding of the adequacy of 
the structures after each flight. 

d. Current tailcone-off ALT flight plans call for less than 
10 hours of flight time, depending upon the impact of initial tests 
and actual flights. 

e. Full-scale buffet can be evaluated at lift-off and the. 747/orbiter 
landed immediately on the dry lake bed if buffet is excessive. 

5. Special Areas of Certification 

This deals with the details of the separation panel, communication 
interface unit, S-band transceiver/antennas and the load measurement 
system as well as the government furnished equipment. The government 
furnished equipment is discussed briefly here, while those interfaces with 
the orbiter are discussed under the orbiter section of tMs report. GFE 
(government furnished equipment) includes the 747 crew bailout or 
escape system, L-Band telemetry equipment, C-band beacon, UHF radio 

and the separation camera. 

{ 
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The crew escape system relates directly to the 747 crew safety 
during the ALT program. The design concept was discussed and 
accepted in the Panel's previous Annual Report and only the pertinent 
areas are mentioned here along with the verification results to date. 

The basic system must provide depressurization of the 747 
crew areas and evacuation route within 5 seconds to preclude any 
adverse impact on crew movement or om the escape-chute system. At 
the same time this is happening an opening is cut in the lower 
fuselage and an aerodynamic spoiler is extended. The escape system 
uses standard, developed, Air Force hardware. All pyrotechnic 
components have been through military qualification testing. The 
verification method is as shown in Table IV-II and the certification 
plan as shown in Table IV -III. 
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TABLE IV -X 


Orbiter Weights 


Structures 


Handling Qualities 


OVERVIEW OF REQUIREMENTS (747 Aircraft) 


performance requirement 150,000 lb to 170,000 lb 

launch altitude baseline 152,000 lb 

structural design 192,000 lb 

commercial airplane design loads criteria per FAR #25 

- minimal deviations only for maneuver load factor 
for ALT of 2.0 

- ultimate crash load factors of 

forward 6.0 

aft 1.5 

side 1,5 

down 3.75 

up 1.5 

- fatigue life based on Orbiter tailcone on mated 
flights. Fatigue to allow 55 ALT Flights and 
265 ferry flights. 

- fail-safe design except 747 nose gear and orbiter 
support structure 

When Orbiter is mated, the carrier aircraft is: 

- safe operation with all stability augmentation failed 

- controllable during take-off and landing in 15 kt x-wind 

- controllable with one orbiter rudder hardover 

- controllable with critical 747 engine failed. 
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AIR-TO-AIR & GROUND 



QUICK LOOK EVALUATION 
MATED AIRWORTHINESS 




REMOVABLE AIRPLANE MODIFICATIONS 




V, ALT OPERATIONS 


A. Introduction 

Much of this area has been covered in other sections of this 
report. ALT planning, procedural and implementing documents have 
been discussed in Section II. This section covers only those ac- 
tivities conducted at the Houston Mission Control Center and at DFRC 
which support the ALT missions. This area comes under discussion 
again in Section IX, "Configuration Management." Thus, this section 
will be very brief. 

B. Observations 

The ALT functional organization is shown schematically in Figure 

V-l. 

1. ALT Scheduling and Status Monitoring 

This area as required for ALT is to be performed under a 
manual system. Schedules will be maintained for three levels, as 
well as any supplemental level deemed necessary. 

The first is the ALT program schedule which encompasses 
the entire ALT program with sufficient detail to show each flight, 
each ground turnaround, each major ground test period, and each NASA 
controlled and ALT planning milestone. 

The ALT Planning Milestones that control ALT scheduling and 
status monitoring system is defined in APD No. 121, dated October 19, 
1976. These milestones start with the 747 on-dock at DFRC on 1/14/77 
and go through completion of free-flights with tailcone off on 1/13/78. 
These dozens of milestones actually cover from 11/1/76 through 3/17/78. 
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The integrated ALT work schedule then plans for a 14 working 
day duration (72 hours/ll days) including all ALT milestones within 
those 14 working days, and all element interaction and external inter- 
face milestones derived from Element Work Schedules. This integrated 
schedule is to be published each working day. The third level of 
scheduling provided the Element Work Schedule which support the 
Integrated Schedule. Finally, a recovery schedule is. established 
when necessary because of difficulties in meeting the next ALT Planning 
Milestone in the Integrated ALT Work Schedule or the ALT Program 
Schedule does not provide accurate schedule information. 

2. ALT Management 

The management structure includes the Manager DFRC ALT oper- 
ations, Active Orbiter Flight Dilector, and the Orbiter Ground Oper- 
ations Manager. 

The documents that deal directly with the day-to-day oper- 
ations both at JSC and at DFRC in support of the ALT mission include: 

MI-108 Customer and Contractor C/0 Support functions 

112 Operational Support and Documentation System 

113 ALT Ground Operations Scheduling Activities (ISSUED) 

118 ALT Control Room Operations 

120 ALT Support Coordination (ISSUED) 

304 Performing Flight Readiness Review 
Only about one-sixth of these have been issued at the time of this 
writing. 
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3. Mission Rules 


As in all missions, a set of mission rules are established 
which specify what is to be done (the decisions are pre-selected) 
for a specific set of events which are off-nominal. These have been 
thoroughly analyzed and tested both on paper and in simulations to 
assure known results. These mission rules are provided for each 
phase of the flight, i.e., mated inert taxi tests, mated prior to 
take-off, mated takeoff, after takeoff, inflight, and so on to final 
position after landing. Typical of such rules for that period of 
flight immediately after takeoff would include: 

- If the landing gear doors are found to be open or gear will not 
retract the decision is to abort the mission. 

- If there is a single blown tire on the 747 an inspection is to 
be made by the proper chase plane to ascertain the exact condition and 
if no other damage is descernable either by chase or by displays onboard 
then the mission may continue as a nominal mission. 

Such rules are developed for each critical area. For instance the 
hydraulic systems may have mission rules which establish five basic 
decisions which can be effected depending upon how many hydraulic systems 
are lost on the 747. These five decisions are: emergency jettison of 
the orbiter 101; abondanment of the 747; abort the mission and return to 
the base; continue the flight in a reduced environment (minimize stresses); 
or continue the flight as scheduled. Thus with the loss of one , two or 
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three 747 hydraulic system the decision would be to abort the mission 
and return to the base, while with the loss of all four systems the 
decision would be to abandon the 747. 

4. Contingencies Operations 

The thoroughness of the planning for ALT flights is demonstrated 
by the contingency operations plans whose objectives are manifold to 
assure that everything that can be done will be done. The objectives 
in chronological order if you will are: preserve life/minimize injuries; 
preserve vehicles and property; secure the contingency landing site; 
secure all possible information relating to the incident; and assure 
administrative actions are taken as required including the appointment 
of an appropriate review board for investigations. 

There are two categories to deal with: (1) abnormal test 
vehicle condition (OV-101, 747, or both) which has produced or is 
resulting in substantial damage to the test vehicles and/or . injury to 
personnel, (?.) Accident or incident involving damage to facilities or 
equipment other than the test vehicles. These are covered in the 
ALT Contingency Plan and by appropriate NASA Agency documents, particularly 
NHB 1700.1 and NMI 8631, IB. 

5. Other Areas of Operations 

The post flight data reduction analysis and reporting system 
includes the DFRC "quick-look" program, The Boeing Company program which 
is to be utilized only through the captive inert flights, all of which is 
to provide summary reports to the ALT manager and his people within °4 hours. 
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Such reports will contain such things as the objectives accomplished, 
the crews comments, engineering comments, and a thorough problem 
assessment. 

Emergency jettison of the inert orbiter, if it were ever to 
be necessary, has been examined to assure that the limits of such 
actions are known. Wiring and controls are provided so that the 
747 crew can initiate the jettison of the orbiter if such a contingency 
should occur. Analyses and simulations have been conducted to assess 
the procedures, jettison capability, and the best orbiter elevon 
fixed position. NASA/DFRC pilots, as well as others, have participated 
in the "man-in-the-loop" simulations. As a result of these activities 
the following results are known so far; 

(1) Successful emergency jettison is very sensitive to the 
position of the orbiter's elevon, and that increased negative or up 
elevon improves clearance for inert flights. Based on the best 
available data at this time it appears that nominal separation requires 
at least a zero-degree elevon to preclude collision. Thus for the ALT 
inert flights the -1 degree up-elevon was selected to assure a safe 
emergency jettison for nominal conditions and a 507, of uncertainty 
range. 

(?) The airspeed range over which a successful emergency jettison 
can be performed range from 700 KnotsCAS to the 747' s Vp/Mp limit speed. 
Additionaly, 747 pushover is required at lower airspeeds to provide positive 
relative normal acceleration. 

(3) The jettison altitude is not significantly constrained, except 
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that an altitude loss of 2000 to 3000 feet may occur prior to 747 
recovery after the release. The jettison time required is about 
6 seconds. 

(4) The steps to be taken upon the declaration of an emergency 
situation requiring orbiter jettison go something like this: 

Left Seat Pilot Right Seat Pil ot 

"Chop" the throttles Arm the jettison system on panel P9 

Deploy the speedbrakes 

Perform a pushover (3 0.3g As the 747 engines approach idle 

initiate jettison through Panel P9 

Maintain the pushover for 
the proper time (6 seconds) 
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VI. GROUND FACILITIES 


A. Introduction 

The Shuttle Master Verification Plan states that Ground Support 
Equipment (GSE) must undergo formal certification by test or analysis 
where the expected environmental conditions, operational constraints, 
or the significance of a hardware failure indicate it is necessary to 
assure an appropriate level of confidence in the GSE beyond that pro- 
vided by acceptance testing. The responsible GSE design group identi- 
fied the ground support equipment and the appropriate test/analysis 
plan, procedures and implementation initiated. They identified for 
Orbiter 101 five models (sets) of quick disconnect filter assemblies 
for the APU, NH 3 servicing, ground cooling, freon servicing and waste 
disposal, and PRSD/FCP. All of these have been certified. 

B. Observations 

1. Key Orbiter GSE Management Documentation 

There are a number of directives and implementation docu- 
ments which guide the development and qualification of the ground 
support equipment. They key items are listed in Table VI-I. 

A key to providing GSE and facilities on-time and in adequate 
configuration to meet the ALT/OFT/Operational needs is strict Con- 
figuration Management (see Section IX) . 

2. Safety Requirements on GSE 

From the viewpoint of safety of operation, ground equip- 
ment is considered in the same light as flight equipment. To achieve 
this a number of steps are taken: 


79 


a. A Safety Critical Item List (CIL) is established as 
described in NASA NHB 5300.4 (ID-1). The policy requires hazard 
analyses to identify a potential hazard and their resolution as well 
as the safety requirement verification which calls for test-to-safety 
margins . 

b. Each end item is reviewed by NASA and Contractor through 
formal design reviews which utilize the RID system to assure that 
issues are identified and formally resolved. 

c. A functional end item verification is performed at the 
completion of the end item fabrication. When that is completed an 
integrated schematic verification is also made. 

d. Other steps in the certification process include the 
station set validation of the GSE-to-Vehicle interface, the update of 
configuration acceptance readiness reviews, and the Flight Readiness 
Review. 

The current plan for GSE to support the ALT program calls 
for use of Station Set 16 and transfer of much of the GSE used with 
Orbiter 101 at Palmdale ("Caravan GSE"). 

3. Facilities 

The team reviewed the Approach and Landing Complex and flight 
operations support facilities at DFRC and JSC. 
a . DFRC 

The basic items supplied to DFRC by KSC for use in the ALT 
include facilities, communications systems and the mate/demate device, 
plus certain government furnished equipment. In addition KSC supplied 
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the requirements for fixed facilities at DFRC as to the tow-way, shuttle 
hanger, mate/demate device foundation, facility AC power, emergency 
power, fire protection and hazardous storage areas, hoists, micro- 
wave tower and other items. The ALT complex facilities were accepted 
from the contractor on August 16, 1976 after acceptable completion of 
all testing. Open items still exist, but are to be closed during the 
January/ February time period for support of the ALT missions as re- 
quired. 


The Mate/Demate Device, since it is unique to NASA experience, 
is probably of interest to the reader and should be described briefly. 

(1) It has a lifting capacity of 225,000 pounds. 

(2) Its structure is designed for maximum winds of 125 mph 
at the 30 foot level. 

(3) Lateral controls will hold Orbiter steady in a 12 knot 

wind. 

(4) There is positive lifting control by three 50- ton 

hydrosets . 

(5) There is a deluge system for spills of hazardous 


materials . 

The communications arrangement for working at DFRC includes an oper- 
ational intercommunications system, a radio frequency communications 
system, and a paging/area warning system. This covers the local area 
and also supplements the DFRC- to- Palmdale 2-wire system with an 11-channel, 
4-wire system. 

The 747 equipment for maintenance and flight support includes 
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standard 747 ground support equipment (GSE) and the Flight Monitor 
Room and Telemetry Processing Area at DFRC. It is in effect a mission 
control room for the 747 up to the interface with the Orbiter. It 
also supplies the direct interface communications between DFRC and 
JSC and its mission control center. The communications at DFRC 
include : 

(1) Air to ground. 

(2) Local ground data flow. 

(3) Tracking data system. 

(4) Telemetry monitor system. 

(5) Chase Plane/Trailer/Long Range Optics Television system. 

While at DFRC the 747/Orbiter will undergo a Mated Ground Vibration 

Test (MGVT) . The details of this test have not been reviewed by the 
Pane 1 . 

b. JSC 

Flight Operations Support has specific areas of responsibility, 
as shown in Figure VI-1. The ALT Mission Control Center has been lo- 
cated on the third floor, Building #30 at JSC. The following functions 
are contemplated: telemetry processing, track processing, communications , 

television, with displays to cover all systems and follow all operations 
on a real-time basis with memory and data playback. The system capability is 
for an update rate of once per second and to process 1,330 parameters 
and record 125 events. It needs to be on time to support the February 
unmanned Orbiter mated flight and fully operational for the fully 
operational Orbiter in March. 
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c. Communications and Data System 

The importance of this portion of the facilities to be 
applied to both the ALT and OFT programs cannot be overemphasized. 

In this area the orbiter is one of the key elements along with the 
ground segments of the communications and data system. The elements 
of the system are not all brought into operation at one time, rather 
they are phased into operation as they become required. Thus for 
the ALT program the requirements include the orbiter, DFRC , one 
STDN (Space Tracking and Data Network) site, OSFC and the Mission 
Control Center at JSC. The first three OFT flights as presently 
conceived do not require DFRC, but add the Launch and Landing 
requirements affecting KSC and MCC (mission Control Center) plus 
an additional ten (10) STDN sites. The remaining OFT 4-6 flights 
require the Tracking and Data Relay Satellite and its ground station 
added to that already used on OFT 1-3. The Orbiter itself adds 
capability in the same way, e.g., during ALT it uses modified 
S-band system, for OFT 1-3 it uses the S-Band PM and FM system, then 
going to the S-Band (PM and FM) plus Ku-Band system adding payload 
interface requirements as needed. The major development effort for 
the OFT MCC will start about the middle of FY 1978. 
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TABLE VI- I 


Key Documents for GSE 


I. Directives 

A. Level II Specification, JSC 07700, Volume X "Flight and 
Ground Specification" 

B. Space Shuttle Program Directive #19, "Ground Systems Support 
Equipment Design and Control System." 

C. Space Shuttle Program Directive #71, "Ground Operations Panel" 

D. Space Shuttle Ground Support Equipment Integration Plan, JSC 08110 

II. Implementation 

A. Orbiter GSE Management Plan 

B. GSE requirements definition document (RDD) 

C. Abbreviated item description sheet 

D. GSE utilization List (GUT,) 

E. Station Set Specifications 

F. GSE Design Requirements, SW-E-0002 
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FLIGHT OPERATIONS SUPPORT 

AREAS OF RESPONSIBILITY 

figure VI- 1 









VII. TRAINING THE GROUND AND FLIGHT CREWS 


A, Introduction 

The Panel reviewed the experience, training and competence of 
personnel. As in reviewing past programs, the Panel has focused on 
skill retention and morale among the ground and manufacturing per- 
sonnel as well as the degree of training received by the flight crews 
in the unique aspects of mission operations. 

A review of training must consider that tight schedules 
historically seem to generate more human errors resulting in equip- 
ment failures and mission anomalies than one might expect from the 
design of the hardware and ’software themselves. Thus training must 
be designed with this in mind to minimize such problems* 

B. Observations 

The observations for this segment of the report are reported 
in Volume I of the Panel's report. They deal mainly with the flight 
crew training at this time, and apply to the Approach and Landing 
Test Program only. 

Flight crew and flight controller training was covered to some 
degree in the Panel's last annual report. The current status of devel 
opment of the simulators and trainers are: 

1. The orbiter aeroflight simulator (HAS') for the Approach and 
Landing Test has been in use since November 1976, Tt can be tied into 
the Mission Control Center for integrated simulations. The Shuttle 
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mission simulator (SMS) to be used for the Orbital Flight Test Program 
and operational missions is expected to be in use in April 1978. The 
OAS motion base crew station is to be updated upon completion of the 
Approach and Landing Test program and will become an integral part of the 
SMS. The SMS will be tied in with the Mission Control Center for 
integrated simulations, The Shuttle Mission Simulator moving base and 
fixed base crew stations will initially provide forward flight deck 
training only. The fixed base crew station will be upgraded later on 
to provide full flight deck training capability by at least the third 
manned mission. 

0 , The part task simulators include (a) crew procedures evaluation 
simulator, (b) shuttle procedures simulator, (c) spacelab support module 
simulator, (d) the interim upper stage simulator, and (e) the single 
systems trainer which has only been conceptually defined at this time. 

The spacelab and upper stage units are not expected to be in use until 
the 1979-80 timeframe, The other two, M a M and "b", are now in use, 

A directive has recently been issued ( T SC SSPD # 75) to ensure 
the establishment and effective formal configuration control of the 
1-0 trainers, neutral buoyancy trainers, training devices, and related 
trainer facilities. This will keep the configuration up-to-date and 
responsive to the most current requirements. 

An area that will be exercised to assure the highest possible 
level of capability is that of post- test data reduction and analysis. 
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This is bound to be a problem in both ground test and checkout as wdll 
as in post-flight operations because the amount of material to be 
processed is so large. Procedures and how they are to be implemented 
as well as dry runs should help to keep this problem in hand. 

The ALT ground team training has been going on concurrently 
with the work being performed at DFRC in readying the ground and 
flight hardware for the ALT flight. The ALT ground training plan 
was developed by KSG, since this area comes under their cognizance, 
and was issued as document K-SM-12.5,01, Personnel requiring specific 
training in certain skills have been recertified through a series of 
intensive courses which are 100% complete. Special areas such as 
those handling toxic fuels and requiring emergency egress procedures 
on the ground have been the subject of training and are 1007 o complete. 
To assure that the ALT turnaround schedules can be met the crews have 
been trained in each of the steps involved. There is of course no 
substitute for the "real thing" which will enhance the skills which 
the ground crews already have obtained. 

The Shuttle Carrier Aircraft (747) Test Team (SCATT) is a mix of 
DFRC, Rockwell, Boeing and JSC personnel. They have participated in 
the 747 test program planning, they were involved in the windtunnel 
and post modification testing and are the Flight Control Room Monitors 
at DFRC. The SCATT members also participated in the mated ground 
vibration test program, the taxi tests and any other area that dealt 
with the flight of the 747. Through a series of detailed reviews 
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these skilled technicians and engineers covered such areas as: 
flight test requirements, real-time monitoring, the DFRC control 
room setup, 747 and orbiter operational limits, flight crew and 
training requirements, and the mated inert flight plans and 
contingency procedures. 

The flight crew training has been detailed and intense over 
the past two years. The pilots and lfight engineers have gone 
through the American Airlines 747 ground training schools and 
simulators, FAA 747-type ratings, current American Airlines refresher 
courses at the ground school and the flight engineers school and 
simulators. An example of the flying experience brought to the 
ALT program: 

PILOTS Total Hours 747 Hours 747 Landings 


12,800 

114 

90 

6,100 

51 

73 

9,450 

55 

61 

9,575 

4 

5 

14,450 

38 

47 


52,375 262 276 


1,025 115 
2,625 105 
3,250 8 
3,000 8 


total 


FLIGHT 

ENGINEERS 
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The "chase" pilots have also been heavily involved in training 
for the ALT flights. The Chase procedures have been established 
and briefly they are that Chase #2 and #3 are to take off before the 
mated 747/orbiter, while Chase #4 will takeoff after. Two additional 
planes, Chase #?A and #3A will relieve the #2 and #3 planes at a pre- 
determined point in the ALT mission. The Chase pilot training includes 
attendance at the Orbiter ground school at JSC, the 747 ground school 
at DFRC, having the chase pilots involved in all crew briefings given 
for the 747 and orbiter crews. A schematic of chase-plane positioning 
is shown in Figure VII-1 
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CHASE POSITIONING - CAPTIVE INERT FLIGHTS 


VIII. SAFETY, RELIABILITY AND QUALITY ASSESSMENT 


A. Introduction 

These areas have been under constant scrutiny by the Panel as a 
whole as well as by a number of Panel Task Teams. Rather than plow 
through ground covered in varying degrees by other sections of this 
report, this section focuses on the mission safety assessment system 
as applied to the ALT project, and the system which screens or evalu- 
ates hazards and safety concerns as a part of the every day program 
operation. 

This task team organized its review to answer the following 
questions : 

1. Is there a reasonable basis of confidence, based on data 
presented, that the ALT mission safety assessment has been thorough 
and adequate, and supports the decision to fly? 

2. What are the major points that should be brought to the 
attention of the Shuttle Management and the NASA Administrator, and 
what will provide the Administrator with the best visibility into 
the risk assessments made to date? 

3. Has the review system really done the job at each level 
of the ALT program, from contractor to NASA Headquarters, and is 
the aggregate risk really understood (including the subjective sum- 
mation of apparently non-major type risks)? 

4. To what degree are the steps followed in reaching ALT safety 
assessment being applied to the many elements that make up the OFT 
first mission? 
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Background data was gathered from the following documents: 

1. ALT (Approach and Landing Tests) Project Safety Assessment, 
JSC 10888, latest issue. 

2. Technical Assessments examining ALT safety hazards. 

3. Space Shuttle Program Safety, Reliability and Quality Assur- 
ance Plan-Level II, JSC 10681. 

4. Space Shuttle Program System Level Open Problem List, JSC 
09925. 

5. Orbiter Open Problem List/Technical Issues, JSC 09079. 

6. ALT Critical Design Review RID list. 

7. Selected PMIR Action Items relating to S, R&QA activities. 

The team then reviewed the adequacy of the data base for these 

reports as well as management use of these reports to assure knowledge- 
able risk management. 

Given the magnitude of the work necessary to adequately examine 
and evaluate the S, R&QA systems a sampling method had to be employed. 
Members of the team participated in the S, R&QA Major Safety Concerns 
Screening Board meetings, and Orbiter Configuration Reviews. Dis- 
cussions were held with NASA and contractor personnel and many of 
the questions and answers are reported in other sections of this 
chapter. 

B. Observations 

1. Orbiter Project-Problem Reporting and Corrective Action. 

Discussions with the Quality Engineering Branch at JSC went 
into details of the Problem Reporting and Corrective Action System 
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(PRACAS) covering the following areas: 

a. Background, purpose, requirements for reporting. 

b. Relationships and data flow. 

c. Reports and problem resolution. 

Problem reporting and corrective action systems have been established 
by all three NASA Centers, JSC/KSC/MSFC, and as far as can ba deter- 
mined at all the element contractors as well. Their mode of operation 
may differ but their purpose and end products are all similar. There- 
fore, at this time the Orblter system was considered as the sample 
system. The way the system works for an element is shown in Figure 
VIII-1 on the Orbiter program. Those problems of a "systems or inte- 
gration" nature are handled as shown in Figure VIII-2. The Orbiter 
contractor renorting requirements are shown in Table VIII- I. 

It is important that this system provide prompt visibility of 
problem so their impact can be assessed and management can take 
appropriate action. Therefore, it is worth noting that 80% of the 
problem notifications occur within the 24 hour standard and the re- 
maining 20% are reported within a few days of occurrence. 

System level problems for major end items and major test articles, 
as well as "commonality" items are reported to JSC. These for the 
most part have been restricted to Criticality I and II types of problems. 
Criticality I and II refer to those which if they occurred during actual 
operations would cause loss of life, loss of mission or both. The re- 
lationship between MSFC and JSC regarding problem reporting is such 
that MSFC reports only Level II, systems- type problems to JSC and 
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maintains its own Level III problems. Two documents issued as a re- 
sult of these efforts are the "Orbiter Open Problem List/Technical 
Issues Only," JSC 09079 prepared by the Quality Assurance Division, 
and "Space Shuttle Program System Level Open Problem List with S, R&QA 
Remarks," JSC 90025, also prepared by the Quality Assurance Division. 

A sample page from the first document is shown in Figure VIII-3 ami 
one sample from the second document is shown in Figure VIII-4a/4b. 

This effort is supported by an information flow system using a 

JSC CYBER computer system with terminals at the NASA resident offices and 

operational sites. MSFC, KSC, Rl/SD and DFRC by the end of 1977. 

data base is at JSC as the focal point for this work. The sections 
of these reports which provide the needed visibility to various levels 
of management are kept in the Management Information Centers at N<*SA 
Centers and their prime contractors. The major problem reports and 
their resolution are discussed at periodic reviews as appropriate. 

The system is described in further detail in the following doc- 
uments : 

(a) NHB 5300.4 (ID-1) sets forth the requirements for contractors 
to provide a closed-loop system for the reporting of all problems and 
the establishment of corrective action, (b) Volume V, JSC 07700, Level II 
requirements define problem reporting and corrective action information 
requirements for all elements of the program, (c) JSCM 5324A and JSC 
09296 describes the JSC on-site system, and (d) NASA/RI contract NAS 
9-14000 Information Requirements Descriptions defines the Orbiter pro- 
ject implementation. 
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2. Materials Analysis Tracking and Control (MATCO) 

Given the Panel's background, the Paxael emphasizes the im- 
portance of controlling the materials used in and around space ve- 
hicles. The team, therefore, reviewed the MATCO system for identifying, 
assessing and controlling materials in their application in Shuttle, 

MATCO is one of the building blocks for safety and reliability 
analyses and assessments since it takes all of the materials information 
noted below and documents it for quick identification, tracking, retrieval 
and control. MATCO also provides "Acceptable Materials Lists" or the 
"directory" in order to assist design personnel. 

- Flammability, toxicity, vacuum thermal stability, 
hazardous fluid compatibility, age-life, stress 
corrosio.i, and fracture control. 

There have been some problems in obtaining all the materials 
data from all the elements of the program and inserting them iiato the 
MATCO format. The current status of the MATCO program is that 
Rockwell Tnternational/SD met all MATCO requirements for the ALT 
Orbiter 101 in January 1977. MSFC has been granted a 

MATCO delay until 1980; however, a JSC audit of the MSFC position con- 
ducted in June 1976, indicated that MSFC is in fact reviewing all draw- 
ings and related documents to assure compliance with program materials 
requirements. 

Further details on the system can be found in the following 

documents : 

a. Level II requirements are established in Volume V and 
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Volume X of the JSC 07700 aeries of documents. These requirements 
are specified in greater detail in JSC-SK-R-OOObB document, "NASA 
JSC Requirements for Materials and Processes" and the Information 
Requirement 2EN-13, "Worksheets, Standard and Accountability Control, 
Tracking Information and Data on Material." 

b. Level III requirements are established through Rockwell 
International Document SD72-SH-0090B, Information Requirement Document 
RA-3obT2, "Space Shuttle MATCO Information and Data System." 

e. Level IV requirements for the Orbiter are established in 
Rl/SD document SD-72-SH-0172, "Space Shuttle Orbiter Materials Control 
and Verification Plan." 

3, Approach and Landing Teat (ALT) Project Safety Assessment. 

This assessment is published in the JSC 10888 document. It 
provides management an assessment of the Shuttle Carrier Aircraft crew 
escape system and aircraft modifications, Orbiter, CPE, Flight and 
Ground Operations. The systematic approach that is used is portrayed 
in the fault-tree schematics shown in Figure Vlll-.'ia , b, c, d, e and 
f. Orbiter systems that are not in operation during ALT are not 
addressed and analysis of the 747 is limited to modifications made 
for ALT. USE is analyzed for single failure points that could cause 
damage to the ALT hardware. The. safety concerns selected lor in- 
clusion stem from JSC Safety Division activities, including the SR&QA 
Major Safety Concerns "Screening" Board. They are chosen on the basis 
of criticality, credibility and significance for aggregate risk. Those 
risks that fall in the category of "accepted risk" are of most interest. 


Other categories ot major interest are the impact oi newly defined 
saioty concerns on those already considered "closed," and the quali- 
tative evaluation oi the aggregate risk. 

Tlte safety assessment aln>w3 there are three accepted risks con- 
sidered major concerns: 

a. Smoko sensor provision in the orbiter crew cabin for ALT. 

b. Single eleven hydraulic actuator. 

e. Bird impact with the orbiter windshield. 

The remainder of known accepted risks are as follows: 

a. The vyow cannot escape trom Shuttle Carrier Aircraft 
in-flight, if it is not in a stable mode. 

b. There is a materials incompatibility of the 747 with 
the ammonia which is used as a coolant. 

e. The vertical stabiliser is vulnerable to damage from 
the orbiter ejection panels released during captive flight. 

d. The. lack of "rip-stop" construction in landing gear 
switching valves introduces some hazards. 

e. A failure in the pressure transducer tube would release 
the hot turbine gases, 

f. There is a possibility tor tank rupture in the A Pit hydra- 
nine system, gaseous oxygen and hydrogen tanks and ammonia boiler system/ 
ammonia tanks. 

g. There is no relief capability for a buildup of the fuel 
cell coolant pressure. 

h. There is a lack of redundancy in the severance system 
for the inner hatch. 
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i. 'flu* redundant pyrotechnic wiving in tact uses common 
cahlos/eotinectors and thus is not redundant at those points. 

j. There may be situations where the"*' is not suttient 
t ime to enp,up,e backup liipht control system. 

k. Tin? "nosewheel steering tail" lip, lit mav p,ive erroneous 

aip.nals. 

The prop, ram has caretully considered each ot these and the prop, ram 
tools it has an adequate rationale tor accept inp each one. This 
rationale is outlined in the report % (,isr 100HR document!. 

The Project stately Assessment also summarises th*' results ot 
sneak circuit analyses, shuak circuit analyses proved valuable on 
previous prop, rams. The work on the Orbit er tor AIT is lvinp, done by hoc inp, tor 
the system contractor and their support 1 *. dements. As noted in 
the Saiety Report, sneak circuits occur when currett i lows throup.h un- 
expected paths, at unexpected times thereby causnip. ambip.uous or false displays 
or unintentional operutinp. conditions, ttincc these conditions could 
damap.e equipment, inhibit an operation, cause inadvert ant operation, 
or present erroneous data, the systematic search and ident i lieation 
ot them means nuinapement can take the appropriate action. 

4. ALT Project Safety Plan 

Tills document, JtU‘ 110 U, "Approach and land inp. Test Project 
Safety Plan" detines the safety orp.anicat ion, establishes satety policy 
and establishes safety responsibilities. JSO provides overall ALT 
sa let v management , monitors the implementation 01 safety policy, 
regulations, and plans, and provides safety pivup tor th*' Rt'AAU'hiter 


] light operations and orbiter flight operations. The AI,T Manager en- 
sures (hat safety policy and plans are implemented. KSC then provides 
safety management for orbiter ground operations and DFRG provides 
safety management for SCA ground and flight operations and serves as 
focal point for safety coordination with Edwards Air Force Base. 

The Rockwell Space Division complies with eonfraetural safety require- 
ments and supports JSC, KSC, nnd DFRG in conduct of safety tasks. 
r > . ALT Major Review RID Status. 

To test the effectiveness of the RTF system in handling safety 
concerns, the Panel asked about the number of Review Item Descrepancieo 
(RID) from the ALT Critical Design Review still open after nine months. 

Hie response showed that only 19 of 44 RID's from the CDR board were 
still open as of October 28, 1976. All RID's which impact the first 
captive inactive flight have been closed, Six RID's which are. open at the. 
time of this report are not a constraint to that flight. 

6. Task Team Questions and JSC Responses 

The team also raised the following technical questions or 
concerns for consideration by the .ISC Safety, Reliability and Quality 
Assurance Office. The questions and answers are provided below. 

Q. Is there any identifiable concern wi tli the Microwave Scann- 
ing Beam Landing System (MSBLS) that could affect the ALT program with 
mated or free flight? For example, accuracy, reliability of operation, 
and integration into a combined autoland with possible manual takeover? 

A. The MSBLS provides data for glide slope, bearing, and slant 
range. MSBLS data is provided to the guidance, and control to faeili- 
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tate automatic landings and to the horizontal situation indicators 
in the cockpit which are used as navigation aids for manual landings. 
Manual landings are currently planned during ALT flights with temporary 
engagement of the autoland system at higher ultitudes. The MSBLS pro- 
vides elevation and azimuth angles within - 0.05 degrees and slant 

4 » 

range within - 100 feet. Single MSBLS data is not used until after 
separation, there are no concerns associated with mated flight activ- 
ities , 

The Safety Division has conducted a hazard analysis of the MSBLS 
and conducted inspections of the DFRC facility. Several issues are 
being tracked as a result of these activities. These include (X) the 
inability to verify antenna pointing and distance measurement accuracy 
in the relatively short period between orbiter drops and shuttle train- 
ing aircraft runs, (2) unexplained deviations in antenna pointing 
accuracy which have occurred at DFRC, and (3) inability to verify the 
MSBLS ground station accuracy because groui\d station errors cannot be 
separated from overall system errors. Recommendations to resolve 
Items 1 and 2 above have been submitted to the tracking and communi- 
cations development division. Studies have been directed to resolve 
the third issue as a result of several RID's submitted at the ALT CDR 
conducted in April 1976. 

No issues have been identified relative to reliability of oper- 
ation because of system redundancy, the short duration of the orbiter 
free flight, and the various system verifications, including those per- 
formed during the captive/active flights. 
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Delivery of waveguides has been impaired because of poor quality 
control. Rejection of waveguides has delayed start of qualification 
tests. If problems continue, certification of wave-guidea for ALT 
may be impacted. 

No issues have been identified relative to MSBLS integration in- 
to a combined autoland with manual takeover. Since MSBLS data is al- 
ways displayed in the cockpit, there is no real transition in MSBLS 
when going from auto to manual. 

Q, An ALT data-link systems review was conducted earlier at 
Palmdale. It was to serve as the final review of the total ALT micro- 
wave data system. What part was played by the S, R&QA people? 

A. .ISC, DFRC and Rl/SD R&OA were present at the review and Safety was 
represented at the review. The review covered site activation planning 
and results of recent tests of the microwave system. Presentations 
were made by Pacific Telephone, GSFC and Rl/SD. The minutes of the 
review have not been released at the time this is written although 
JSC ground data systems personnel have indicated that no major con- 
straints were identified. This system is under contract to GSFC. 

JSC, SR&QA personnel do, however, support activities such as the ALT 
flight and ground operations planning group meetings where planning 
and issues associated with the data-link system are discussed. Al- 
though the system is required for integrated testing and system veri- 
fication during ALT, it is not considered safety critical. Malfunction 
of the microwave link or the complex at Palmdale prior to the GO/NO 
GO transmission from Palmdale would result in a mission scrub. The 
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system is not safety critical during Orbiter tree 1 light. 

Q, What tests are to be conducted to prove that the tailcone 

will, stay affixed to the orbiter during ..Kited flights? What would 
happen if the tailcone were to become partially and/or totally de- 
tached from the orbiter either during nulled or during tree flight? 

A. The tailcone and its attach fittings are designed and certi- 
fied for flight exactly like all other orbiter structure. All orbiter 
structure for ALT is certified primarily by analysis such as flight 
loads analysis, internal loads analysis, stress and fatigue life 
analysis, and flutter analysis. Tests Lhat will be conducted to 
supplement these analyses include extensive wind tunnel tests and a 
mated orbiter/SCA ground vibration test. Also, because structural 
verification tests will not be conducted for ALT, the ALT flight 
operations will be restricted to ensure that the maximum flight loads 
on any portion of the orbiter structure do not exceed 757o of the limit 
load predicted by analysis. 

Q. Have you considered the use of instrumentation such as 
simple bridging wires that would give you an early warning of a 
possible separation of the tailcone so that you could get back safely? 

A. This sounds like a reasonable approach and will now be investigated. 

This was reviewed subsequently by Rl/SD and determined not to be necessary 
because the analysis and ground testing were sufficient. 

Q. If ammonia is being used anywhere on the Orbiter, is it 

safely vented overboard to preclude injurious effects on the orbiter 
or the 747? 

A. The Ammonia Boiler System (ABS) for orbiter 101 consists of 
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two systems, designated "A" and "B", each containing three K-bottlcs 
each. The bottles in each system are manifolded in'o a single line 
feeding through a solenoid isolation valve, a flow control valve, and 
finally into the ammonia boiler. The boiler exhaust port is locate* 
on the right aft fuselage at the base of the vertical tail and is 
directed upward. Maximum flow rate through the boiler exhaust will 
be approximately 2.25 pounds per minute. 

An assessment of orbitcr 101 materials compatibility with ammonia 
has been performed by Roekwell/Spaee Division. Under normal oper- 
ating conditions, (assuming no tank/line ruptures), the Orbiter will 
be exposed to ammonia vapors only. Periodic inspections will be per- 
formed to verify normal operation. The fuselage, wings, and vertical 
tail are aluminum alloys containing less than b% copper and are 
generally unaffected by ammonia. The crew module aluminum contains 
b.8% copper, but is primed and painted and is thus protected. Elec- 
trical wiring and equipment are environmentally sealed. Rockwell/Space 
Division's assessment of both the fused silica tiles and the poly- 
urethane Simulated Reusable Surface Insulation shows no anticipated 
incompatibility with ammonia. 

As a result of orbiter 101 delta PDR RID 09,02.70, "Effects of 
Orbiter exhausts on Carrier A/C and Crew," an assessment was made on 
the 747 materials. The sj stems and components investigated included 
engine, APU's, air conditioning system, vertical tail structure, wiring 
and mechanical components, fuselage structure, and internal electrical 
systems. At the concentration of ammonia vapors predicted, no problems 
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are anticipated. Aluminum has a corrosion rate of less than 1 mil 
per year for exposure to moist ammonia gas up to 212° F. Dry ammonia 
has no appreciable effect on alumi.v 


7. Additional items of interest. 

Another area of interest was the position of the hydraulic 
system linos, system-to-system, since the anomaly on the Orbiter 101 
landing gear test proved that when hydraulic lines are positioned 
near one another there is a chance that anything that causes line 
failure in one can adversely affect others. 

The program is reviewing the effectiveness of rudder and 
eleven rates and aerodynamic control qualities at this time and this 
will be followed oy the Panel task teams. 

Another area of continuing interest is the low APU fuel 
capacity inherent in the Orbiter 101 which makes it necessary to 
have the APU's turned off and on during the flight. 


st 
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v. la&tnna UaEJlEilSl^. 


A number of Item* have been of interest, e.g,, contingency 
abort capability and planning, lightning protection, etc., which 
have been addreased since the task team reviewed the status of 
the Safety and Reliability aspects of OFT flight. This data could 
bo placed under the OFT section of this report as well as in this 
section. 

In continuing its review of abort planning and capability, 
with resultant risk or no risk acceptance, the f’nnei feels that it 
would be worthwhile to identify requirements for aborts other than 
those currently specified. . .Abort to orbit (ATO) , return to launch 
site abort (UTLS), and Abort once around (AOA) . 

Lightning protection has been discussed in Section XXI, F.xternnl 
Tank and Solid Rocket Booster, and has been a subject of discussion in 
previous Panel reports. Because of the number of program initiated 
studies and the desire to make the Shuttle system as independent of 
environmental factors as possible, the panel will examine the 
results of the many activities now in nrocess. 

The emphasis being placed on the testing of the hydraulic system 
as a whole and the major components to assure safe and reliable operation 
during the Orbiter 101 and 10^ flight activities will continue to be 
followed to help assure that nothing fa 11)- through- the- crack. Areas 
such as the Dynatube connections which must be leak-tight (do you lock-wire 
these connections or not?), the fidelity of the test configurations in 
regard to the actual flight equipment (credibility of test results?), 
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maturity of the hydraulic circulation pump (is ! lie performance 
really known under operational conditions' 1 ), and the decree of 
instrumentation on actual first flights during which the total 
hydraulic system is to be operated. 
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TABLE VIIW 


ORBITER CONTRACTOR PROBLEM REPORTING 
REQUIREMENTS 


Problem Notification— -All problems that occur during or 

subsequent to acceptance test shall 
be reported to JSC within 24-hours of 
occurance. 

Problem Documentation— A documented report shall be provided 

to JSC within 5 days of the reportable 
item identification. 

Problem Disposition— —A documented report shall be submitted 

21 work days after initial report to 
document the cause and corrective action 
or rationale for not implementing corrective 
action. 

Open Problem List-- — —A report shall be submitted weekly beginning 

21 days after the start of the certification 
program listing all open reportable problems 
and the status of actions being taken to 
resolve each. 


o 
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ORBITER PROJECT FRACAS RELATIONSHIPS 





SPACE SHUTTLE INTEGRATION PROBLEM REPORTING AND CORRECTIVE ACTION SYSTEM 
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ALT Mission Operations Fault Tree 
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ALT Orbiter System Fault Tree 




VII I-5d ALT SCA Fault Tree 

















Figure VIII-5e ALT System Operations Fault Tree 










IX. CONFIGURATION MANAGEMENT AND INTERFACE CONTROL 


A. Introduce Ion 

The general significance of the configuration management eyetea 
for the Panel la that it assures that the prograa knows what is in 
fact being designed, built and tested so that the real risks are iden- 
tified and dealt with. It forces a necessary degree of discipline on 
every level of a complex prograa and thus Is an Inherent technical and 
administrative activity of any NASA and DOD program. The syatem does 
not force the use of unnecessary paper or levels of management but 
does require that there be sufficient documentation to assure that 
management, design and user organizations have timely information 
necessary for effective decision making, risk assessment and program 
control. 

Because of the significance of this system the Panel made it a 
point to emphasize in its last Annual Report that the Panel had not 
yet cosipleted consideration of other Important system integration 
Issues such as configuration management, interface control and inter- 
action between Shuttle syatem elements but that it Intended to do so 
as soon as feasible in terms of its large workload. This section re- 
porta on the Panel's review to meet this cosmltment before the ALT 
flights. In fact the Panel felt that an examination and assesssmnt 
of the Configuration Management System as it is both documented and 
implesiented is one of the basic steps in assessing che adequacy of the 
ALT management system in establishing a real basis for confidence in 
achieving mission success and flight safety. 
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The Panel in designing its review of this area considered the 
demands the system must successfully meet. 

1. The system must support the program* ability to pro- 
duce hardware and software that is capable of being qualified and cer- 
tified for flight, and then can be maintained, replaced, or modified 

as information on operational characteristics becomes available through 
flight tests. 

2. The Shuttle Program is as diverse as its predecessors, 
the Apollo Program, Skylab, and the Apollo Soyua Test Project. It has 
numerous prime contractors and technical support spread all over the 
country and there is bound to be some degree of non-standardization as 
well os coordination problems. These will be difficult to overcome 
even with the dedicated people known to be working these areas. 

3. Element and integrated system aggregate risk assess- 
ments must be based on knowledge of the "as-built" and "as-tested" 
hardware and software. Accepted risks and their justification must 
also be based on such known configurations. 

4. Development, qualification, and acceptance testing 
schedules are extremely tight and overlap with manufacture and instal- 
lation requirements. Therefore, hardware and software mismatches and 
materiel problems, resulting from inadequate configuration management, 
can lead to schedule and cost impacts. Inadequacies therefore must 

be minimized. 

Therefore, the Panel focused on the following elements of the 
configuration management system: 

1. The system as documented. 
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a. Level I, IX, III atid IV requirements and procedures. 

b. Orgr niaatior.al responsibilities and intercenter 
relate onnhipci. 

c. Relationship with Master Verification Plan. 

d. Configuration accounting system and repositories. 

2. The system as implemented. 

a. Decree of configuration control being applied to 
each element to determine current baselines. 

b. The processing of actual hardware/software changes 
from inception to completion. 

c. Documentation to relate the "as-designed" to the 
"as-built" to the "as-tested" hardware/software. 

d. Activities cf the Space Shuttle Program Configur- 
ation Management Panel (SSPD #6), the Level I, II 
and III Program Requirements Control Boards (PRCB's) 
and the systems engineering support provided to 
these activities. 

c. Use of Configuration Management products to support 
the Space Shuttle Review system, e.g., CDR's, DCR's, 
and Flight Readiness Reviews. 

f. The relationship betweeix logistics (maintenance, 
spares, etc.) axxd the Configuration Management 
System. 

g. Relationship between Safety, Reliability Quality 
Control and the Configuration Management System. 

Since the following fundamental terms are used in this section 
of the report, they are defined to avoid any confusion. 

1. Configuration Management System. The total system to 
(a) identify and document the functional and physical characteristics 
of all program hardware and software and the major test operations on 
them, and (b) control the processing of changes to the hardware, soft- 
ware, test functional and physical characteristics. 
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2 , Configuration Management . The set oi policies and pro- 
cedures to implement the system. Those must cover requirement s , iden- 
tification, control, accounting, and vorUicatlon. 

). Interlace Control or Management, The specilic set of 
policies and procedures to govern situations where one element, such 
as the Orbiter, is dependent on another, such as the External Tank. 

The interlace or two-dimensional plane between elements must be de- 
signed and manufactured so that when the elements come together they 
match in every detail physically and operationally. The control oi 
the internal interlaces such as between the electrical genera ting and 
distribution system and the flight. control system within the Orbiter 
is within a single NASA Center and single prime contractor. On the 
other hand Interlace Control is between elements which means between 
prime contractors and NASA Centers. Thus a change considered by the 
management oi one element must be considered in terms ot its impact 
on the other element and their integrated operation. 

The observations that follow are based on the program responses to 
specific questions, direct quotes from briefing material and notes 
made during discussions. 

H. Observations 

1 . dene ra 1 In forma t i on . 

The Space Shuttle program has streamlined the configur- 
ation management methodology which evolved through Apollo, Sky lab and 
Apollo Soyus. Paperwork has been reduced, efficiency increased and 
changes made to some basic operating principles. 

1?3 


The four levels of the program are shown lit Figure IX-1 


along with the elements that mike, up each level. In addition there 
is a system of Boards - the Program Requirements Control Board (PRCB) 
the Cost Limit Review Boards (GLRB's) and the Change Control Boards 
(CUB's). These are shown in Figure IX-2. 

Briefly the established prerogatives for each level 


are : 


Level I - Program Director controlled requirements 
and direction. 

Level II, - Program Manager controlled requirements and 
direction that normally affects more than 
one project office. 

Level III - Pro i e e t Manage r controlled requirements and 
direction that clearly affects a single 
project office. 

Level IV - Project Element /NASA design activity/con- 
tractor controlled requirements implemen- 
tation and direction that clearly affects 
only the respective element for which the 
design activity/contractor has responsibility, 

The Program Director located at NASA Headquarters, has 
a single document that covers the Level 1 activities (Program Directive 
Pit’,, July 5, 1973, "Establishment of Change Procedures To Space Shuttle 
Program Requirements - Level 1 Control Documents.") The Program Direc- 
tors n rogram Requirements Control Board does not meet often as most of the 
Level II PRCB operations are conducted at JSC with teleconference 
arrangements to both NASA Headquarters and other appropriate NASA Cen- 
ters and contractors. During these board operations the Level I in- 
put is made informallvto those managers making Level II decisions. On 
the other hand the Cost Limit Review Board at Level I is quite 


active, meeting on the average of once eaehwenth to make decisions 
transmitted to it via Level IX or determined as necessury at Level 1 
itself. There is no program directive establishing this CLRB and 
defining its operation; but, since it has been in action lor some 
years, it is not expected to require such documentation at this late 
stage of the program. The Program Director in Washington uses the CLRB 
to control costs and the PRCB to control ''reserve;!* , l.e., computer memory 
reserve capacity or electrical power generation capacity reserves. 

The workload at Level II requires the services of three 
Civil Service persons and nine RI contractor support persons. Hie 
nature of such work also requires the part-time use of technical per- 
sonnel from other NASA divisions at .ISC. 

In addition there are Level III and IV systems at the 
project level that must function effectively to assure an adequate 
total system for decisions made here that are not reviewed at higher 
management levels . 

Interface controls are under the purview ol. the Systems 
Integration Office at Level II and their mode of control and use follow 
that for normal Level II operations. 

The operation of this system Is discussed in more de- 
tail in the following sections. 

2. Configuration Management* Requirements 

The basic philosophy used in developing the requirements 
is: "Tliis document has been jointly developed by the Manned Spaceflight 

Centers, and represents a careful application of the experience gained 
in previous NASA 3 military, and commercial space and aircraft programs." 
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To bo effective from the standpoint of producing hardware and soft- 
ware in a timely, orderly manner within the cost constraints, con- 
figuration control by NASA is established only "when and where it is 
necessary and when it will tend to stabilize program efforts. Caution 
must be taken to prevent premature control and control at too low a 
level of detail." 

These requirements are set forth in JSC 07700, Volume 
IV, "Configuration Management Requirements," baselined March 2, 1973 
and a Revision A issued in April 1974. Changes are made as required 
by reorganizations, personnel changes or to meet the demands of the 
ongoing Shuttle program. Through November 1976 sixteen changes to 
this document have been processed and incorporated. 

The additional documentation used by the program and 
examined by the Panel ere as follows: 

a. "Level II Baseline Description and Status Re- 
port," JSC 08102, published monthly and contains about 70 pages of 
computer printout. 

b. "Space Shuttle Orbiter/System Integration Con- 
tractor Configuration Management Plan," SD73-SH-022A, June 23, 1975 
issued by Rockwell International, Space Division. 

c. "Shuttle Carrier Aircraft Project, Configuration 
Management Manual," JSC 08140, January 13, 1975. 

d. "Space Shuttle Program Configuration Management 
Panel," SSPM Directive No. 6A, July 3, 1974. This directive established 
this Panel as a mechanism for reviewing, assessing, advising and guiding 
the proper integration of configuration management activities across 
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the program. 

3. Configuration Identification. 

Identification refers to the manner and documentation 
for describing in detail all program hardware and software. Require- 
ments and configuration are identified in detail for the practical 
purpose of producing hardware and software which meets or exceeds 
specified requirements and is a baseline used for control and account- 
ing of changes as they occur. 

The baseline at each level of the program requires those 
types of data shown in Table IX- I. Note that the interfaces are taken 
into account in these listings. 

An integral part of the Identification process is the 
assurance of hardware traceability. Traceability is the identification 
technique of correlating historical records to each item. These re- 
cords are valuable in resolving hardware problems, understanding age- 
life characteristics and helping to assure reliable and safe flight 
and ground equipment. 

To illustrate the set of documentation required for a 
project (Level 111) here is the documentation required for the Shuttle 
Carrier Aircraft: 

a. All the applicable requirements of the NASA Level I 
and II baselines. 

b. Specification MJ510-0001-1, "Shuttle. Carrier Air- 
craft Contract End Item Specification - Design and Performance Re- 
quirements." Baselined by the Shuttle. Carrier Aircraft Project Manager 
on April 9, 1976. 
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c. Specification JSG-08943, "Flight Test Requirements - 
Volume I - Shuttle Carrier Aircraft." Baseliiaed by Orbiter and SCA 
Projects on December 12, 1975. 

Configuration Identification includes the Interface Con- 
trol Documents (ICD's) used to control interfaces between two or more 
participating contractors and government agencies. In effect the ICD's 
augment the contrac-tural specifications by documenting the requirements 
and agreements between interfacing contractors and/or NASA. The con- 
tent of these ICD's can be seen on Table IX- II which is from ICD #2-17001, 
"Orbiter/Carrler Aircraft, Ferry and ALT. This particular ICD is unique 
in that two configurations are presented, both of which involve the 
Orbiter and the 747 aircraft, that is, ferry flights and the ALT. 

Identification also includes drawings - a drawing tree 
for both flight and ground systems (this is in effect a directory of 
drawings), engineering drawings and a part number control system. 

4. Configuration Control. 

The baseline as established at any given time must be 
protected from inadvertant and/or unauthorized changes. The baseline 
is normally a product of such configuration reviews as the Preliminary 
Design Review (PDR) and the Critical Design Review (CDR) . In addition 
to these traditional reviews, the Space Shuttle program has added 
a series of incremental design reviews. For instance there is a system 
of reviews to consider the design in light of prior testing and before 
proceeding to the next step of the program. These are called Customer 
Acceptance Readiness Reviews (CARR's) or Configuration Inspections (Cl's) 
Thus there was a Phase I configuration inspection in the Spring of 
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197b which reviewed the design in light of testing and whether it was 
ready to proceed through individual subsystem testing. Then a Phase II 
review waa held in October 197b to consider what had been learned about 
the design from this individual subsystem testing. A Phase III review 
in late January 1977 considered the proof of design in the light 
of integrated testing. The Phase 111 review authorises the program to 
proceed with final testing and delivery oi the vehicle. 

Configuration control i.s maintained through strict 
change management. Change management is effected through the use of 
Configuration Control hoards (CCB's) which are shown in Figure IX- 2. 

The bevel I and II CCB's are referred to as Program Requirements Con- 
trol Boards (PRCB's). The membership of these boards has been estab- 
lished so that, every change request receives a thorough going-over by 
the board and by the supporting technical and administrative groups. 
For instance, the Level III Orbiter CCB is supported by the Orbiter 
Configuration Control Panel, the USE Configuration Control Panel, 
Orbiter Software Design Review Board and those Technical bw^tus Re- 
views required as a part of the normal technical design information 
flow between NASA and its contractors. 

The change control flow is shown schematically in 
Figure IX-3. One should note the placement and use of the CI.RB which 
is a distinct change from previous programs. The Level I PRCB con- 
tains about 10 members, while the Level I CLRB contains b members. 

The Level II PRCB contains about 29 members and the Level II CLRB 
contains only 5 members. Each level, of course, has its own author- 
ities and responsibilities and the PRCB and GGB's control all items 
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not affecting the next higher level of management. However, in the 
ease of high cost items, the CI.RB operates concurrently with the PRCB 
and quoting from Volume IV, JSC 07700, Page 4-4, "The Level II Cost 
Limit Review Board is the controlling authority for all Level III 
changes with projected expenditures which deviate from program and 
project cost plans by more than $500,000 in any fiscal year. All 
Level III changes with a dollar value in excess of $500,000 in any 
fiscal year shall be dispositioned by the Level II CLRB and, if 
approved, shall be forwarded to the Level I CLRB for dispositioning. 
Level II. changes with a dollar value exceeding $500,000 in any fiscal 
year, or $1,000,000 total for payload related changes shall be pro- 
cessed through the Level II PRCB or CLRB; and, if approved, forwarded 
to the Level I PRCB or CLRB for disposition. Level I changes regard- 
less of dollar value are forwarded to the Level I PRCB for disposition." 

It was noted that in the case of the Shuttle Carrier 
(the 747), the dollar value was different. Level II is to be notified 
by a memorandum from the SCA Project Manager when the change value 
exceeds the figure of $300,000 at any time. 

The Panel task team examined samples of changes trans- 
mitted to the CLRB as well as the minutes of such Boards. The system 
appears to be working well and the degree to which encutnberances slow 
down the system is not known at this time. However, the personnel 
with which this was discussed indicated that no time was lost in the 
process and it may even preclude things from "falling into the crack." 
Since the same paper is used at each level, the amount of paper is 
not too great and the approvals are readily apparent. The task team 


130 


examined a number of l'HCIi Minutes and Directives to ascertain the 
depth of material covered, action items and distribution, A sample 
"change package" was selected (actually several were examined) at 
random to provide an example of the system and how it worked in real 
life. The change selected was identified by Ho. R01911, "t timbal 
Actuators - 3 port versus 4 port," It affected the arbiter and the 
Space Shuttle Main Engine and the Solid Rocket Booster which use such 
actuators. The change was originated in the engineering division at 
JSC and superceded a previous change request. The paperwork indi- 
cated that this was a mandatory change costing as much as four million 
dollars during a four year period. Level III Orbiter CCB approved and author- 
ised the forwarding of this change to Level II on August 5, 1975 since 
the cost was over the S500K limit. The Level II CLUB approved the for- 
warding of this change to Level I on August 29, 1975, and Level I 
approve! was given on October lb, 1975. The change was, at the same 
time, undergoing assessment and impact analyses by the cognisant 
technical organizations so that the change was fully evaluated in 
terms of cost, schedule, engineering and safety, reliability and 
quality assurance requirements. It x«is then reviewed and approved 
by the Level II PRCB because it affects more than one project as well 
as being a high-cost item. The directive to implement the change was 
issued on October 21, 1975 with specific actions to be accomplished 
by the end of November 1975. At that time an addendum to the original 
directive was prepared and signed out February 28, 1976. The close 
out paper shows the actions taken by the appropriate MSFG project 
offices and contractors. Direction was given to the contractor and 
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NASA internal documentation was modified accordingly. Project re- 
views assure that the change was made, 

A special effort was made to review the configuration control 
as app ied to the most significant items or claments of the Approach 
and Landing Test Project ;» These elements included the test vehicles 
and supporting CSE, support resources and the operating plans and pro- 
cedures. Table IX- II I succinctly shows the item, control mechanism 
and the accounting. The activities are divided between JSC, Di'RC, 

KSC, and Rockwell International, Space Division. 

4. Configuration Accounting. 

The accounting portion of the configuration management 
system provides visibility to every level of management and working 
organisations as to the status of the baseline, changes to the base- 
line and actual hardware configurations and software posture. In 
addition, almost all of the myriad groups in the Space Shuttle program 
require such data for safety analyses and assessment, reliability and 
quality assurance assessment, weights, status reporting, logistics, 
mission planning, etc. 

Configuration accounting activities are divided into 
two areas: (a) baseline accounting and reporting, and (b) config- 

uration verification and accounting. Item (b) will be discussed 
separately. Each NASA Center and their contractors utilise different 
systems to provide the required data. These systems were developed 

by each organisation from their prior programs. Since the 

necessary data is provided there is no need for uniformity in the 
system. Because of the focus on ALT and Orbiter, this discussion will 
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center on Level II at JSC and their support by Rockwell, end the 
Level III at JSC covering the Orbiter and the 747. 

The current system at Irogram Level IX and Orbiter 
Level III is called the "Baseline Accounting and Reporting System" 

(BARS) . It uses the Rockwell International /Space Division computer 
system and software. The BARS system has the capability of record- 
ing, integrating, statuslng, and reporting data for the NASA Levels 
I, II, and III baseline requirements, Rockwell, as the System Con- 
tractor, has personnel located at JSC, MSEC and KSG to perform the re- 
quired duties. NASA and other element contractors submit on a regular 
basis to the System Contractor such information as: 

a. Level IX Change Requests 

b. Level II Documentation Changes 

c. Engineering Change Proposals (all projects, Level III) 

d. NASA COB and PRCB Directives 

e. Level II Change Evaluations 

f. Listings of ICD's and specifications, and updates 

g. NASA Technical Directives (all projects) 

h» Contract Change Authorisations (all projects) 

i. Other Closeout Documentation (Level II, III and 
All Projects) 

j. CCB Agenda and Minutes on All Projects 

A good deal of this data from the NASA Centers is put into the system 
through a remote terminal setup at JSC, KSG and MSEC which links them 
to the Downey Computer Unit. 

The output of this BARS setup can be formatted in any form required 
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by management or the technical organizations. There are, of course, 
many specifically identified reports produced because they fit a con- 
tinuing real need by user groups. For example, the baseline documents 
listing noted before, bevel II Change Status Reports each week, PRCB 
bevel II actions status reports each week, and so on. 

5 . Configuration Verification 

Configuration verification is accomplished by Rockwell 
International Space Division in support of bevel II and III program 
management. They use the data from the individual Prime Contractors 
as well as the Configuration Accounting System and manufacturing and 
quality control reporting systems. Thu-: they are able to provide: 

a. Requirements verification used at all major re- 
views of the hardware and software. 

b. Verification of the original baseline configuration 
and the changes to it. 

c. Verification to ensure that the "as built" config- 
uration is compatible with the "as designed" configuration and the "as 
tested" configuration and that any differences are understood, 

In addition to this work, a system level hardware/software verification 
method is being developed to support the first OFT test, checkout and 
flight programs. 

The PRCB action items are closed by furnishing 
the Level II PRCB secretary with the following types of documentation 
to show the PRCB direction has been implemented: 

a. Configuration Control Board Directives 

b. Contract Change Authorizations 
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c. Change Orders 

d. Supplemental Agreements 

e. Technical Directions 

£. Directive-Type Memo's or Letters. 

Wljen all actions on PRCB directives have been closed, the Level XX 
PRGB secretary will sign a "closeout" block on the directive. 

6. Ground Support Equipment Configuration Management 

The "station set" concept has been used in managing 

GSE. A "station set" is an integrated system of GSE units to accom- 
plish a specific function or functions. Functional systems within a 
station set arc identified as "sub-sets." The method of configuration 
management for these station sets is the same as described for other 
elements of the Shuttle hardware and software. There is no require- 
ment for traceability on GSE but much of this could be obtained through 
the current accounting system. 

7. Major Ground Test Articles 

Test articles required to support such tests as the 
Ground Vibration Tests, Mair Propulsion Tests, and Vibro Acoustic 
Tests are essentially covered by the same configuration management 
system described previously. Tills, of course, is necessary when 
dealing with items of flight hardware being used in the tests to 
assure that changes do not adversely effect the hardware. 

8. Interface Documents and Their Control 

All XCD's have been baselined. There are twenty-one 
Level XX ICD's which cover the interfaces between the major elements 
of the Shuttle program, e.g., between Orbiter and External Tank, etc. 
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A list oi those is shown in Table IX- IV. This does not include ICD's 
which interface the Payloads, or the memorandum of understanding that 
have been developed between such NASA Centers, as JSC/USFO on communi- 
cations and computers, and DFRC/JSC on the operation of the ALT pro- 
gram. Interface managers are assignea to each of nine interface areas. 
They direct the continuing activities, coordinate accomplishment of 
working group action items and manage preparation and maintenance of 
the individual ICD's, The top group that oversees all of this is the 
"System Integration Review" or SIR group at Level II. 

9. Shuttle Software Configuration Management 

Shuttle software is supplied to the Rockwell Inter- 
nal ional/Space Division as t'FK (Government Furnished Equipment). The 
types are: 


a. Vehicle flight software 

b. Vehicle ground test software 

c. Laboratory soil ware 

d. Engineering design aids 

o. Laboratory support software 

For our purposes, the software follows the path noted below from in- 


ception to validation; 


Specified By 

Rockwell 
NASA 
Vendors 
IBM- Houston 
G.E. Co, 


Coded By 

Rockwell 
NASA 
Vendors 
IBM- Houston 
G.E. Co. 


Verified By Validated By 


Rockwell 
Vendors 
IBM- Houston 
G.E. Co. 


Shuttle AviouicB Inte- 
gration Laboratory, 
or SAIL in JSC 


Given its development cycle and end use software requires configuration 
management controls similar to the ones for hardware. In summary, the 


n 


o 
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Shuttle So It ware Operations Plan mul lunet tonal divert ive are bcinp, 
ve leased to provide project-wide common procedures lor sol t ware 
similar to hardware procedures and current sol t ware is be ins controlled 
like hardware through the engineering and quality assurance review 
system. These items are be in;* followed to completion by the l.evel II 
Space Shuttle tVmlip.urat ion Management Panel at .ISO. 

10. Hesponses irom Prop, ram/ Pro Jett Personnel to Sped lie 
Quest ions . 

As a part ol its examination oi the Shut tle font ip,u rat ion 
Management system the task team, during this the lirst review ol this 
system, posed a aeries ol questions which have been answered by .ISO 
as lo llowo: 

q. Wh.it is the situation ot the OSH re eonlipurution 

management'.’ 

A. All items ol OSH are under strict configuration 
management alter OPR baselininp,. Any ehanp.es other than "make work" 
must come through the Orbit or ehanpe system tor approval prior to 
makinp, the ehanpe. Major modifications come back t hroup.h a OPR and 
Peaip.n Review Board lor approval. Orbtter 101 ALT utilities certain 
non- OSH items that are required tor test and checkout but are below 
the level of OSH. Those are standard tool crib tools, such as wrenches, 
scopes, etc. plus certain work stands and special test equipment used 
in manui no turlnp, that have application in the ALT prop, ram. The use 
ol these equipments are controlled by the test and checkout procedures 
which are approved by the NASA. Also, pen* iodic calibration is per- 
formed on equipment which requires calibration, up.ain the test and 
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checkout procedure require!? a current calibration on the equipment 
prior to use In the tests. 

Q. The Master Veriiication Plan and Requirements 
Documents are many and detailed. Wien chanp.es are made in the MVP 
and/or in hardware or software, what concrete methods assure com- 
patibility between these documents, changes, and the test program? 

How close to flight configuration are the test items used for 1/4- 
scale testing as well as the Ml'TA and so on? 

A. Shuttle development, as with past programs, is 
success oriented with regards to development, qualification and 
acceptance testing, ‘litis approach is necessary in order to meet 
development schedules as well as to prevent excessive costs associated 
with extension oi hardware development schedules which would be re- 
quired to allow lull qualification prior to hardware delivery and 
installation or qualification. While problems will be encountered, 
such as the hydraulics problem, which will require rework/redesign, 
the overall effect of the concurrent development /product ion is con- 
sidered cost and schedule effective. 

The conditions noted regarding potential failures of 
hardware causing damage to 1 light and teat hardware due to concurrent 
development /test of the hardware can and has happened; however, the 
development data used to confirm design concepts prior to hardware 
production generally prevent catastrophic failure of the hardware 
under test. In major tests, such as the MVtJVT, MPTA and FRF, the ele- 
ment supplying the test article is required to establish capability 
of the hardware to survive test conditions at the hardware acceptance 
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and teat: readiness reviews. While this cannot assure no failures, 
particularly where test conditions have not been adequately estab- 
lished, it is expected to greatly decrease risks of any major failures. 

The master verification plans (Level II) are used as 
the basis for each sub-tier (element) verification plan. Deviations/ 
variations to the Level II requirements are negotiated with the ele- 
ment project offices/contractors at the time of approval of the Level 
III plan. The Level III plans are Type I documentation, requiring 
NASA CCB/PRCB approval. Detail test requirements for element hard- 
ware are reviewed and approved under the umbrella of the Level III 
verification plan. If the Level II plan/requirements change, this 
change requires Level II PRCB approval with appropriate direction 
to the elements for their implementation. Deviation to Level II 
Master Verification Plans require Level II approval. 

Q. GSE Preliminary Design and Critical Design Reviews 
are conducted on a fairly continuous basis. How does configuration 
management system keep up with these activities? 

A. Approved changes from PDR' s/CDR's are transmitted 
to the contractor (s) . For major impact changes, the contractor pre- 
pares a Master Change Record (MGR) which is evaluated for ICD im- 
pact by a systems integration and ICD group. The MGR then goes to a 
contractor engineering change board at which time ICD impact is iden- 
tified. If a change affects an ICD the contractor prepares a Pre- 
liminary Interface Revision Notice (PIRN) to charge the ICD. 

For minor impact changes, engineering orders (EO's) are 
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prepared to change drawings. The EO's are evaluated for ICD impact 
by the System Integration and ICD Group. If the affected drawing is 
identified aB one which impacts an ICD per a master matrix, then a 
PIRN is written. 

PIRN 1 8 are technically coordinated and submitted into 
the appropriate Level II or Level III configuration change system. 

Q. What is the program posture on application of con- 
trols to documents /hardware/ software which must be. adequate and timely? 

A. While the IGD 1 s themselves are Class I documents, 
during this phase of the Shuttle program the design drawings have not 
been baselined as Level II or III documents requiring Class I con- 
trols. Design changes reflecting ICD requirements are subject to 
Rl/SD program manager's control utilising the Master Change Record 
(MGR) system. During Orbiter/Shuttle formal design review, the de- 
sign is jointly validated to contract requirements, including ICD's, 
by NASA and Rl/SD. 

Q. To what degree are test conductors being confronted 
by "red- lined" drawings? 

A. Test conductors funetionto procedures (i.e., test 
and checkout procedures, TCP's) rather than drawings. Test variances, 
TVAR's, are the primary means of documenting changes after TCP release. 
Redlining of TCP's during test are incorporated and authorized by 
TVAR which reflect the required NASA approvals. Minimal redlining 
of drawings for manufacture/assembly are authorized. Such redlined 
drawings are impounded by Quality Assurance a:id verified to subse- 
quently released updated drawings. 
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Q. For those areas under Class I control, are you 
running into the ay, e-old problem of making the paper look like the 
hardware? 

A. Make-work design ehany.es duriny numui'aeture /assem- 
bly/ test are strictly controlled by the Rl/SD nonconformance system 
as documented by Standard Operatiny Procedure Series J-04. In practice, 
the system requires the implementiny paperwork to remain open until 
the desiyn change (i.e., EO) is released and verified. 

Q. What is the situation with USE controls versus 

past practices? 

A. On the Shuttle program the pendulum was swung to 
the extreme in the other direction and even items that are normally 
classified as "factory equipment" are identified and controlled as 
USE, All non-GSE items, especially CEE, are identified and con- 
trolled at the GSE station set level. 

Q. Are there any EO problems and drawing revisions? 

A. The only drawings with more than 10 EO's out- 
standing are structure drawings which are primarily multi-sheet 
drawings. Engineering Release Operations continuously monitors this 
requirement and keeps the responsible senior project engineers in- 
formed of such items. 

Q. Summarize what: the Shuttle Configuration Manage- 
ment system provides. 

A. The Space Shuttle system: 

1. Provides a systematic approach to the defi- 
nition of the program management, technical 
and cost baselines. 
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2. Provides the Space Shuttle Program Manager with 
the required visibility (in concert with all 
program/project management representatives) to 
make decisions that change the program base- 
lines , 

3. Insures that all affected program/ project ele- 
ments have reviewed and evaluated the proposed 
changes to the program baseline. 

4. Identifies to program manager the cost, schedule, 
weight, etc., impacts of such changes „ 

5» Precludes unauthorised change to the program 
baseline. 

0, Provides visibility of the changing baseline. 

7. Provides the mechanism to insure proper communi- 
cation and implementation of baseline change 
decisions. 

8. Provides a structured approach to program 
direction. 

9. Provides the mechanism for positive verification 
of the implementation of the program baseline 
and changes to it. 


C . Information Update 

A mo wo random of agreement is in process to cover the Range 
Safety System hardware and control documentation, to provide a 
basis for the orderly processing of changes and the maintenance 
of configuration control over the commonality hardware delivery 
dates, allowable temperatures for the system, qualification test 
requirements and so on. This is being done at MSFO to cover 
the external tank and the solid rocket booster prelects that are 
under their management . 

There is a current effort to assure management that all of the 
interface areas are being covered by the proper technical and management: 
personnel. As an example the following interfaces which affect the 
Orbiter are being examined to assure their proper resolution: 

1. T-0 umbilical disconnect bend ing loads 

?. Orbiter roll control during vertical mate 

3. srb ignition overpressure measurements 

4. OMS pod and payload bay door graphite epoxy water absorption 

5. All of the Payload to Orbiter to Or omul interfaces 

6. Orb it or /FT ice accretion in the umbilical door cavity 
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TABLE IX- I 


The NASA Space Shuttle Baselines 


Level I 


a. Program definition 

b. Program characteristics 

c. Program interface requirements 

d. Program verification requirements 


Level II 


a. Level I requirements 

b. System responsibility allocations 

c. System schedules 

d. System budget and cost allocations 

e. Management System requirements 

f. Information requirements 

g. System design and performance requirements 

h. System Interface requirements, excluding interfaces 
to be controlled by a single project office. 

i. System verification (acceptance, certification) requirements 

j. Commonality requirements 

k. Standard design and construction requirements 
applicable to the total system 

l. Other applicable allocated requirements 

m. Training requirements 


Level III a. 

b. 

C ♦ 

d. 

e. 

f. 
g* 

h. 


Level I and II requirements 
Design and performance requirements 
Interface requirements 
Verification requirements 

Design and construction standards and specifications 
Training requirements 

Design concepts, approaches, and solutions at the 
appropriate time 

Product configuration descriptions at the appropriate time. 


NOTES: 1. Level I documents include Program Directive #lG, the Program 

Approval Document (PAD), and other applicable Headquarters input. 

2. Level II baseline is best described in the Volumes I through 
XVIII of JSC 07700, "Space Shuttle Level II Program Definition 
and Requirements." 

3. Level III baseline contains specific requirements applicable 
to a particular project or element of the total system, e.g., 
Solid Rocket Booster, Orbiter, External Tank, Space Shuttle 
Main Engine, Launch Support System. 
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TABLE IX- I I 


Part A 


Section X. 


Section 2. 


Section 3, 

3.1 

3.2 

3.3 
3. A 


Section 4, 


Part B 


Section 1. 


Section 2. 


Section 3, 
3.X 

3.2 

3.3 

3.4 


Section 4. 


ICD TABLE OF CONTENTS, IOD-2-17001 


Scope (Orbiter/Oarrier Aircraft, Ferry) 

AppXicabXe Documents 
Inter f ac e Re qulr eme n t s 

PhysicaX Interfaces (7 sections included here} 

Structural Loads (5 sections included hero) 

Environmental Characteristics (3 sections included hero) 
Electrical (2 sections included here) 

Abbreviations and Acronyms 


Scope (Orbiter/Carrier Aircraft, ALT) 

Applicable Documents 
Interface Requirements 

Physical Interfaces (13 sections included here) 
Structural Loads (5 sections included here) 
Environmental Characteristics (3 sections included here) 
Electrical (12 sections included here) 

Abbreviations and Acronyms 
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TABLE IX-XV 


space slums; level ii 

INTERFACE CONTROL DOCPMJiHTS 
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2-QA00X 
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2-1A00X 
2-1A002 
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13M15000 
2-12QQ1 
2-X400X 
2- 2400X 
2-X700X 
2-00001 


Main PropuXaion Test ArtieXe, Physical 

Main PropuXaion Test Article, Electrical 
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Ground Vibration Teat, Facility 

Space ShuttXe/VAB at KSG 

Space ShuttXe/Pad at KSG 

Orbitcr/Landing Station 
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Orbitor/HypergoX Station 

Orbiter/Seeondary Landing Station 

Orbitcr-Mate-Deroate 

ExternaX Tank/Reeeive and Checkout 

Flight Vehicle/Launeh Proceaaing Syatem CompXex 

SoXid Rocket Booater/Reeoiving and Checkout 

SoXid Rocket Booater/RotrievaX 

Orbiter/Space Shuttle Main Engine 

Qrbiter/External Tank 

Orbitor/SoXid Rocket Booater 

ExternaX Tank/SoXid Rocket Booster 

Orbiter/Carrler Aircraft 
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' X. ORBITAL FLIGHT TEST PROGRAM 

A. Introduction 

The orbital flight test program is the last phase in the verifi- 
> cation process. It demonstrates the total vehicle capabilities under 

1 operational environments. Many aspects o£ the 102, e.g., aerosurface 

^ and hydraulic system development, are also a part of the 101 story 

| and in that respect are covered under Orbiter 101 l'or the ALT. The 

Panel is also monitoring those subsystems on Orbiter 102 which would 
not be proven on the Orbiter 101/ALT flights as well as the major new 
elements, i.e. , Main Engine, External Tank and Solid Rocket Booster. 

Later reports will deal more directly with the Orbiter for the 
first OFT. The purpose of this section is to describe the objectives 
and the major issues to be investigated through the OFT program so 
that; the following Sections X and XT covering the SSME, ET and SRB 
are put; in the proper context. 

B. OFT Objectives 

The program objectives are to verify (1) the performance of each 
of the subsystems across the board, (2) the integrity of the inte- 
grated or total vehicle, (3) the operations and checkout procedures, 
(4) Compatibility of the vehicle with tha ground 3ystam, (5) the 
orbiter-to-payload interface, (6) payload handling Including deploy- 
ment and retrieval, and (7) specific capabilities and orbital/sortie 
maneuvers . 

For each phase of the. OFT mission there are a number of "issues" 
that are to be investigated to meet the OFT program objectives. There 
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are ten phases noted by the program and at least 55 Issues within 
those phases, e.g. a 

Phase- Liftoff and boost issues - propellant slosh dynamics 

thermal load, external tank 
POGO (Stability and Control) 

While the Panel does not have the resources to track each issue, 
the Panel does monitor the handling of the most significant ones. 

Volume XI "Shuttle Orbital Flight Test Requirements" of the Master 
Verification Plan series of documents establishes the OFT require- 
ments which must be verified or demonstrated during the Space Shuttle 
Development Flights. 

Because of discussions concerning the appropriate use of the 
concepts "demonstration" and "verification" in terms of certifying 
the system, the following definitions are given as found in the 
"Master Verification Plan-Def initions : " 

" Flight Demonstration refers to the verification of the performance 
of the flight vehicles under a predetermined mix of flight conditions," 

" Verification is the process of planning and implementing a pro- 
gram that determines that the Shuttle System meets all design, per- 
formance, and safety requirements. The verification process includes 
certification, development testing, acceptance testing, flight demon - 
stration , pre- flight checkout, and analysis necessary to support the 
total verification . process ." 

Thus, demonstration is only one facet of the verification process. 
C. Risk Assessment 

The Panel also monitors the handling of the major safety concerns. 
The latest issue of the "Major Safety Concerns," JSC 09990 is of sig- 
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niflcance hero becauae It underlines the risks and/or concerns asso- 
ciated with the OFT and ALT test program. These were considered by 
the Panel in planning the direction the Panel task teams should take 
in reviewing the SSME, ET, SRB and other unique aspects of the 
Orhiter and launch/recovery facilities. 

For example, the Panel tracks the programs handling of open 
safety concerns such as the use of the SRB nozzle extension separation 
ordnance during the first OFT and the ET thermal insulation flammability. 

The Panel also monitors the system for abort and contixxgency plan- 
ning. The Panel's interests were defined in the Panel's 1976 Annual 
Report (Vol. X, Page 17-19).. 

P. Additioxial Data of Interest 

There are numerous factors that must be evaluated and trade-off 
assessments made for each flight. For example, the ascent segment of 
the mission required such evaluation of the vehicle loads, thermal 
stresses, operational techniques, separation techniques, communications 
coverage, abort plans, range safety, error sources and so on. Flight 
planning for on-orbit segments include such evaluations of attitude 
limitation, crew activities requirements, flight test requirements, 
consumables management and so on. During the de-orbit, entry and 
landing stages of the mission the same is true of such things as 
evaluation of energy management, communications, actual systems 
performance versus predicted and so on. 

It is expected that the flights will begin with a crew size of two 
because of the number of ejection seats (two) . The Orbiter, as designed, 
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can actually be flown by one crewman, so that having two or more 
adds to the safety of operations. The last two OFT flights will 
have four crewmen onboard if prior flights indicate that this is 
a prudent move, 

The time between Shuttle OFT launches is approximately 9. to 2 1/2 
months with a greater time expected between OFT #1 and #2 and a lesser 
time between OFT #5 and #6 due to the "learning curve" as experienced 
on all previous programs. 

Current planning shews the following broad information, which 
can vary with maturity of the program. 

OFT-1 Launch and entry performance under the very be3t of 

conditions to optimize for a safe mission. 

OFT- 2 On-orbit systems tests. Increased launch and entry loads. 

OFT-3 Remote Manipulator System operation/verification. More 

detailed thermal testing and again somewhat increased 
launch loads to further explore the safe capability of 
the system. 

OFT-4 Further thermal testing, operating payload deployment, and 

again somewhat high entry loading. 

OFT-5 Work towards proper payloads approach and capture in orbit. 

Working with increased size crews, and further overall testing 
to furthedr define results from previous missions. 

OFT-6 Final tests prior to going operational with heavy payloads, 

off-nominal tests on all systems as applicable, and EVA. 

All of these will exercise the KSC Launch and Landing Systems. 
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E. Orbital Flight Teat Design Certification Review (OFT-DCR) 

This review is a major program milestone whose purpose is to 
review and certify that the design meets the OFT requirements as 
verified by test or analysis, and should have substantiating data 
that validates that those requirements were actually met. The 
present date for this review is set for May 1978, but may vary 
depending upon the degree of completeness of the test programs. 
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XI. SPACE SHUTTLE MAIN ENCINE 


A. Introduction 

The SSME Critical Design Review was completed at the end of 
September 197b capping a review cycle that commenced in April. The 
status of the program at that time could be summarised as follows. 

The potential of the design has been demonstrated and it is an accept- 
able risk to proceed with the flight engine fabrication. A number 
of major problems persist and redesigns have been defined where necessary. 
Flight engine, ,°00A design has been released, A deltn-CPE is scheduled for 
February 1977 owing to the number of major items to be resolved, e.g., 
the oubsynchronous whirl and turbine cooling problems, the full-scale 
brazed nozzle. Thus, by the end of February 1977 the following key 
objectives should be accomplished: 

1. Operation of the Space Shuttle Main Engine at Rated 
Power level (R'MA for long durations, e.g., bO seconds at RPL as a 
minimum. 

2. Development of the procedures and demonstration of them for 
use in "start-to-RPL" testing with the 77.5:1 flight-type nozzle. 

3. Operation under altitude simulation conditions. 

4. Testing of the SSME Heat Exchanger with oxidizer and 
resolution of the propellant conditioning problems, 

The material that follows provides further detail on the results 
of the CDR and testing program and the status of problems and their 
resolution. 
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B. Observations 


1. Significant Items From the SSMF, CDR. 

The engine design was critiqued by the following teams: 
the Engine System Team, the Mechanical and Fluid Systems, Controller 
Team and the SSME Controls team. The CDR Board, chaired by the SSME 
Project Manager from MSFC, reviewed the results of these team reviews 
and concluded that the CDR had been conducted in considerable depth 
and the results presented with candor. The disposition of all sig- 
nificant RID's was reviewed in detail and approved. The SSME Project 
accepted the following action assignments in addition to the RID 
actions : 

a. Provide appropriate JSC insight into the Design Verification 
Specification rebaseline for system related issues. 

b. Increase the visibility for MPTA (Main Propulsion Test 
Article) configuration differences from flight engine requirements. 

c. Provide an appropriate review of the closeout actions taken 
on significant RID's. 

The CDR RID's are shown in Table XI- I. There are 45 RID's 
from the Engine Systems Team, 35 from the Mechanical and Fluid 
systems, 9 from the Electromechanical Controls group, and 16 from the 
Controller group. The RID's considered significant are noted in the 
Table XI-I by an asterisk next to the RID number. The current status 
of RID action assignments and closeout are shown in Table XI- II. 

As for the Main Engine Controller, the baseline unit was 
originally the P-4 Engine Controller. However, because of numerous 
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changes based on tests /analyses over the past- sin months the P-0 
controller was considered as the baseline item to be critiqued at this 
review. This baseline has the following modifications over the P-4 
design: the heater set point, POGO related changes, software simpli- 

fication dealing with the use of dual sensors, power supply changes, 
uses of dual coils in the electrical system, an asynchronous demodu- 
lator, elimination of memory parity errors, variation in the use of the foam 
used to reduce problems resulting from vibration, elimination of many 
electrical jumpers and "cuts," changes to history memory, temperature 
sensor range changes, power supply buss bar connection, Digital Com- 
puter Unit no-go timer, etc. The effect of such changes will be de- 
termined through a combination test and analysis program. Such qual- 
ification requires close attention to be assured that the baseline 
(P-6) as now accepted is in fact acceptable. 

Other major items reviewed, discussed and noted at the CDR 
include the following: 

a. SSME management made a special point of the fact’ that 
every individual on the program has the responsibility to make sure 
nothing falls-through-the-crack by paying attention to everything 
they do and being aware of the program activities in general. 

b. The "long pole in the tent" or major critical objective 
to be met is the attainment of the specified performance from the 
turbomachinery . 

c. The engines used in the Main Propulsion Tests at NSTL 
will probably not have all the modifications which apply to flight 
engines, and the contractor and MSFC will do all they can to keep 
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these differences to a minimum. 

d. 'flic biggest uncertainty in defining the achieved 
Specific Impulse will be the combustion efficiency, C' v . Test re- 
sults to date indicate that this should be no problem. 

e. Temperature and pressure stability conditions at the 
propellaitt inlet have been demonstrated in test. 

f. The POGQ suppression system accumulator no longer 
utilip.ee the teflon balls to cover the liquid/gas oxygen interface. 
Instead a baffle arrangement has been designed to retain the stability 
of the liquid/gas interface. See Figures XI-1 and Xl-2. 

g. The improvements that have been made to uprate the 
engine thrust include the reduction of I.PFTP discharge duct pressure 
loss and increasing the turbomachinery head and efficiency by de- 
creasing the inducer tip clearance and modifying the inducer trim on 

the LPOTP as well as by under-filing impeller vanes ox\ the HPOTP, by re- 
ducing I.PFTP clearances and improving seals and under-filing impeller 

vanes on the. HPFTP. 

h. Hazard analyses have been completed on the engine 
heat exchanger for such possibilities as coil leakage, spark igniter 
"fail-on" and uhe failure of the limit control for stability and 
vibration. The FMEA for POGO has been updated and shows six single 
failure points, for which appropriate solutions have been identified. 

In addition the traceability system for materials and components has 
been computerized and is in operation. 

i. Changes are being made in the manufacturing process 
for the flight nozzle to alleviate buckling which resulted during 
previous brazing operations. Part of this problem resulted from 


tubes with uneven wall thicknesses, 

2. SSME Project Status 

The status of the project as presented here is, of course, 
like a snapshot in that it shows the engine project as of the date 
of writing. Progress is continually being made in all areas of the 
project and this assessment requires updating as tests and analyses 
are accomplished, 

a. NSTL Tost Activity 

There are two test stands in use: Stand A-l in which 

engine 0003 is installed and Stand A-2 in which engine 0002 is in- 
stalled. 87 tests had been conducted on A-l and 38 tests on A-2 by 
the end of the first week of December 1976. Engine 0003 has been 
run at a sustained thrust level of 75% of UPL. Engine 0002 was oper- 
ated for the first time for 3.7 seconds on December 3rd in the A-2 altitude 
simulation (diffuser) facility with the 77.5:1 flight nozzle. In all 
of the current engine firings several different versions of 
the high pressure fuel turbo pump are used. These pumps carry modifi- 
cations which have proved sufficient to cope with the subsynchronous 
whirl problems and bearing cooling. 

The various Engine Controller Units are being used as 

follows : 


BT-1, Engine 0003 on NSTL Stand A-l 
PP-1, Software Support at Honeywell 

PP-2, Upgraded at Honeywell and now at MSFG Simulation Lab 
PP-3, Engine 0002 in NSTL Stand A-2 

P-4, Acceptance testing continues 

P-5, Completed initial integration testing and acceptance 
tests continue 
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b. Engine 0004 Status 

There was a weld failure in the main injector during 
the powerhcad proof test. The eraek occurred during the second cycle 
of a five cycle test and extends around the injector portion of the 
power head. The pressures were about 7700 psi in uppor chamber and 
9400 psi in lower chamber with ambient external pressure. The electron 
beam weld that failed was in the lower chamber. The poworhead weld 
has been repaired and has successfully passed the five cycle test. 
Further, certain lessons learned regarding such welds and their charac- 
teristics should be helpful in supporting not only the SSME welding 
program but perhaps those of other Shuttle elements. For example, the 
"nailhead" portion of the weld must not carry high loads (stress/strain). 

c . Turbomachinery 

The high pressure fuel turbopump (HPFTP) "whirl" 
problems and bearing cooling problems have been under attack for some 
time now. The causes of the whirl problem have been identified, so- 
lutions determined, stability thresholds predicted, and safe operation 
demonstrated up to 36,800 rpm. It was concluded that complete rede- 
sign was not required. Basic fixes have included increased stiffness, 
elimination of deadband, decreased "drivers" and added damping, The 
term "drivers" relates to internal hysteresis, the Alford Effect, 
interstage seals, non-linearities, deadband. It was determined that 
the turbine aerodynamic forces were not the principal- type driver. 

Various combinations of these modifications have been incorporated in 
the three HPFTP' s and have had slightly differeiit degrees of success. 

Two additional turbopumps are being assembled with additional instru- 
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mentation and modification to the inboard bearings. Those will bo 
tested in the near future and should do oven bettor than the three 
mentioned above. Deadband is the "play" in a system, or the avail- 
able motion through which the shaft can move without effective re- 
sponse from adjacent parts. Further testing is in progress on NPTT, 
engines and at in-house laboratories. Tt is hoped that this problem 
will be adequately resolved by February 1077 so that the program 
can meet the schedule for a 60-second Rated ’’ewer Level (RPL) firing. 

The turbine cooling for the HPFTP hae been the subject of much 
attention at the same time that subsynchronous whirl has been of con- 
cern. There have been turbine end bearing failures and hardware cracks 
resulting from insufficient cooling capacity, .'he following actions 
have been taken: 

(1) Turbine cooling is to bo enhanced by improvements in the 
high pressure coolant supply, tip seal, and piston ring, 

(2) Fuel coolant directed to the turbine end bearing (pro-start 
flow) . 

(3) Raffle incorporated in the 2nd stage turbine wheel hub to reduce 
the pressure loss in the coolant vortex. Tests have confirmed that vortex 
was the primary cause of turbine end overheating. 

(4) The bearing test program will cover the existing bearings, an 

improved cage bearing and the use of a roller bearing. A better under- 
standing of the cooling circuit can be gained from Figure XI-3. 

(5) Procurement of a 45 mm heavy-duty type bearing as a backup unit. 

The performance or efficiency of the turbomachinery has, in some 

eases, been below that required by the design specifications. Depend- 
ing on the turbopump the efficiency ran between 107 and 15% low and the 
head between 5% and 15% low. 
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The low pressure oxygen turbopump (I, POTT) has shown dramatic 
improvement when the inducer vane and the tip clearances were changed, 
e , g . , vane height increased and tighter clearances, Tests will con- 
tinue on these modifications and include those involved in POGO sup- 
pression. The high pressure oxygen turbopump (1IP0TP), although low 
in head (6%) and low in efficiency (10%) based on COCA-1 tests, appears 
to be sufficient to meet current engine performance requirements. None 
the less further actions are being taken with the hope that with in- 
creased head, reduced speed improved suction performance can be achieved 
through underfiling the Impeller. The low pressure fuel turbopump 
(LPI'TP) low head problem is being worked through modification of the 
inducer trim and improvements in the volute design. Tire high pressure 
fuel turbopump (IIPFTP) besides the "whirl" problem has experienced a 
6,5% low head condition at RPL. A number of changes are. being made 
to bring the head and efficiency up to a higher level. It should be 
emphasized that such performance problems are a nor null part of the 
development cycle for large high performance engines and were exper- 
ienced on the Saturn M and J-2 engines, 
d. Combustion Devices 

The Thrust Chamber Assembly has been undergoing a series 
of "bomb" tests to develop the stability rating. The fourteen detona- 
tions were successfully completed and recovery from all disturbances 
was within 5 milliseconds. The bomb and bomb locations within the 
main injector of the thrust assembly are shown In Figure XI-4; the 
thrust chamber pressures based on such tests are shown in Figure XI-5. 

The other major item in this subsystem is the 77.5:1 flight nozzle. 
There have been fabrication problems over the past months because of 


the cooling tubes, new thermal design loads and the brazing process. 

Most of this has now been cleared up and testing of the reworked 
nozzle is now underway. Nozzle testing at C0CA-4B stand at Santa 
Susana has been successful in terms of characterizing the nozzle heat 
load, pressure drop and performance as well as the nozzle side loads 
and transient behavior during ignition and transition to higher and 
higher power levels. Some of the significant results of this testing 
are: 

(1) The heat load turned out to be about 65% of the calculated 
value . 

(2) The pressure drop was 297 psi versus a calculated 316 psi. 

(3) The I 8 p value was 455.3 seconds. (Calculated) 

(4) The side load was about 65% of the design value. 

The redesign of the nozzle jacket to cope with latest heat loads pro- 
vided by the JSC and Rockwell International/Space Division for the flight en- 
vironment will cost an additional 140 pounds per engine. This re- 
design is shown schematically in Figure XI-6 and XI-7. The nozzle 
tube rupture during proof test appeared to be caused by weak spots 
in the wall thicknesses. The problem was traced back to the tube 
manufacturer's tube drawing machine, which produced reverse taper in 
the tubes. Tubes for the three R&D and two MPTA nozzles to be used 
in development tests will be selected from those currently available. 

Tubes will be inspected and those which yield a safety factor of 1.4 
or higher are to be used. Only the new tapered tubes having a minimum 
safety factor of 1.5 will be used on the flight nozzles, 
e. Controller 
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The controller hardware and software are beginning to 
jell. Controller maturity would Indicate ... t the option of a backup 
unit may never be needed. The IVL’-l unit has more than 1200 hours of 
trouble free service, the PP-3 mounted on engine 0002 has 500 hours, 
and the PP-2 at the NASA, simulator laboratory in MSI’C has more than 
b20 hours. The P-4 controller has been delivered to support the 0004 
engine test program, and controller P-5 has been delivered to support 
the 2001 engine test program, which is the MPTA unit. The other MPTA 
units designated F-l and F-2 are presently scheduled for delivery in 
March and April of 1977. The, development verification tests for the 
improved power supply unit hav» been successfully completed. The 
unit included those configuration changes addressed to the P-0 con- 
troller, e.g., EMI fixes, power transient mods, vibration fixes, pro- 
ducibility improvements. Another configuration update is being made 
to the PP-2 controller to bring it up to the P-4 configuration for 
use in the MS Ft! sim lab. 

Because, the P-b controller is now the flight- type, baseline con- 
troller and it has some twenty-one changes from prior P-4 controller 
which was the baseline, it received a Preliminary Design Review (PDR) . 
It will also be reviewed again through a special Critical Design 
Review at the. appropriate stage of testing. 

Some of the changes for P-0 are: 

(1) New heater set point 

(2) Changes related to POGO 

(3) Software simplification changes dealing with the use 
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of dual sensors. 


(4) Power supply changes (mentioned above) . 

(5) Use of dual coils in the electrical system. 

(6) New asynchronous demodulator. 

(7) Deletion of cuts and jumpers. 


Software appears to be moving along at a compatible pace with 
the engine teBt program and the MPTA andSAIL operations. The soft- 
ware utilization plan which ties engines, controllers and the develop- 
ment program tests to software development schedule is shown in 
Figure XI-8. A Flight requirements baseline review has been com- 
pleted and this baseline is under Class I configuration management a3 
a Rocketdyne responsibility with NASA Technical concurrence. 

£,, Additional Items of Interest 

There had been indications that Incoloy .,03 which is used 
in portions of the SSME will have significantly reduced life capability 
when subjected to hydrogen flow in a form of hydrogen rich steam at 
1400° F, Tests conducted by Rocketdyne indicate the same thing. 
Additional tests are being conducted to gather more data on the physical 
properties involved and more specific data on life cycle values. The 
components where Incoloy 903 is used include: 



(1) 

Hot Gas Manifold Liner 

Max. Temp. 1200 

o 

(2) 

HPOTP Turbine Housing 

12 /Z 


( 3 ) 

HPOTP Turbine Inlet Strut 

1150 


( 4 ) 

HPOTP Inner Stage Seal 

1000 


(5) 

HPOTP Exhaust Strut 

1000 


(6) 

HPFTP Bearing Support Seal 

875 
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(7) 

HPFTP Turbine Support 

700 

(B) 

HPFTP Bellows 

600 


The problem is Low Cycle Fatigue reducing the life expectancy, which 
is related to environmental and hold-time effects. High Cycle Fatigue 
is related to the processing and surface effects. Resolution of this 
concern at elevated running temperatures is expected by the end of 
January 1977. 

Major SSME milestones as seen at thlB time are shown in Figure 

XI- 9. 
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C . Information Update 


The number of tests conducted on the S8ME are quite large since 
this period and for some months to come, will be devoted to develop- 
ment tests at NSTL on two test stands, and at the Santa Susana sites. 
The resolution of the turbomachinery whirl and cooling problems 
require tests to be conducted as often as possible to determine 
state-of-the-resolutlon. For instance, at NSTL Stand A-l four and 
even five tests a week have been made. Perhaps the major area of 
concern is the ability of the analysts to reduce the test data and 
to thoroughly digest and understand what it means before going into 
the next set of tests. One thing that mitigates this problem is the 
small steps or incremental method of attacking the problem and this 
permits smaller pieces of data to be handled at any one time. 

Tests to date indicate problems are yielding to the engineering 
attack. The engine 0003 in stand A-l has been operated at 1007o of 
rated thrust for more than 10 seconds and it has been operated at this 
level more than two times . 

Engine 0004 assembly is proceeding with very few problems and 
the major remaining work is the installation of harnesses and some 
fluid lines. This engine is being assembled with dummy fuel pumps 
which will be changed at the time the engine is received at NSTL. . 

Full power level operation of this engine is expected to take place in 
March 1977 with conversion to the MPTA configuration in the following 
month. 
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Fngine Controller Unit 'H 1 -? has been delivered to MSFC after 
retrofit and is in process of being integrated into the MSFC 
Simulation Laboratory. The laboratory has been running simulated 
engine firings as if it were engine 0003. The Flight** I software 
is being developed and appears tc be on schedule. 

A close watch is made on the RTD's resulting from the CDR, and 
as they are closed notification is made to all interested parties. 
The first status report dated January 11, 1977 showed that seven 
RIP's had been closed (S-21, S-29, S-32, M-l, M-2, M-4, M-103 . 
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RID SUMMARY TABLE XI-I 





SSME Critical Design Review 









KFO' 










Actio nee 



Hr FTP Turbine 















, Enel* 


(Sheet ot 


SSME - CDR 

j 1 " Space Shuttle 

HI, VIEW 111 MUI'i, •*«,.! UNO 
CI.OSUUM 

RID No, , 

As appropriate 

September 27, 1976 

' . < « A i » 

RID Init iator’s Name 

. ... *t|t / t\ 1 |i,H 

RID Initiator's 
Organization 

’>Y .11 M 

SSME 

l | A M H A M • 

CDR Team 


nut 

RID I.D. No, and Title 


RIO Closeout Instructions 


1. Complete heading of RID Closeout Form# 

2, Define action taken; 1 , 0 ,, 


Category 
'A- 1 

A-2 

A- 3 


Action 

Actionee identify released formal engineering, quality, test, 
etc,, document at ion which implement a the requested action, 

Actionee identify ECP submit ted or contract change authorized 
to implement the requested action. 

Actionee identify report resulting from requested study or 
investigation and recommend appropriate action. 


A-4 Actionee identify the Revel I or II requirement change or 

deviation request submitted to change system. 

D Actionee document rationale for disapproval, 

DR Actionee document consideration of recomrnondflt ion. 

(Note; CDR Board requested these actions be documented, 
therefore, a Closeout Form is required) 

3, Actionee should sign and date Closeout Form and forward to MSFC, SA52, 
Attention; Mr, Scott Boothman, 


4, Contractor signature, for actions not assigned to Rocketdyne, will be 

obtained by the MSFC gSME Project Office as required, 

5, SSME Project Manager's signature completes all necessary RID action. 

6, Copy of completed RID Closeout Form will be forwarded to RID Initiator, 


L 


Rocketdyne 
j * n 


N Ai,A bl* < f» • 


\ t n\ <" 


James R, Thompson, Jr, 
SSME Project Manager 
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TABLE XT -I I 


RID No . 
S-?l 

S-29 

S-32 

M-l 

M-o 

M-4 

M-10 

E-l 

E-3 

E-4 

E-5 


SSME RI D STAT US 


STATUS 


"System, Validation of Casting and Suppliers" - First article 
inspection has been performed on all castings procured for 
Period "A". Period "B" castings will continue to be processed 
through full Material Review Board for acceptance. CLOSED. 

"Drying Purge" - Requirements for SSME post operational flight 
and post ferry flight drying purges at all landing locations 
were provided. CLOSED. 


"GSE-Thrust Chamber Nozzle Sling" - Rocketdyne will provide 
a sling for single engine use and the Orbiter contractor will 
ass an adapter to their horizontal installer for on-the- 
vehicle thrust chamber handling. CLOSED. 

"Combustion Chamber Stability Verification" - Bomb stability 
rating were completed and a summary of the test results examined. 
All stability bomb detonation disturbances to the main chamber 
were damped with 4 milliseconds. CLOSED. 

"Contamination Blockage of Main Injector Fuel Passages" = 

A change has been made to incorporate screens on the main 
element feed passages to eliminate contamination of the 
main combustion chamber baffle sleeves and attached elements. 
CLOSED. 


"Flight Nozzle Thermal Protection System" - An ECP has been 
submitted and is in work. 

"Overhaul Costs" - This RTD has been eliminated as the 
deition of such costs requirements from the CEI specification 
has been accomplished. 

"Servoswitch and Servovalve Replacement"was assessed and favored 
the retention of the released design concept. RID not approved. 

"Hydraulic Actuator Hold Mode Operation" capability is to be 
demonstrated as a part of and ECP and testing. RID not approved, 

"Postion Control and Hydraulic actuator position sensor (RVDT) 
interaction" modification will eleiminate the effects of channel 
cross-coupling. CLOSED. 

"RVDT Linearity and Control Precision" has been established through 
an engineering change using appropriate insulation to make the unit 
operative in the required thermal environment. RID not approved. 
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TABLE XI-II Continued 


E-7 "Hot Gas Temperature Sensor Design Change" was authorized through 
an engineering change to decrease response time, CLOSED. 

E-8 Recommended a model study to define the hot gas temperature 

sensor response time required to provide the required degree of 
engine safety. A study was conducted and the response of 0.3 
seconds is sufficient to meet the requirement. CLOSED, 

S-22 "Antiflood Valve Failure" position indicator as a part of the 
start logic or engine shutdown. Recommended action is being 
taken via an engineering change. RID not approved. 

S-23 "Antiflood Valve Checkout" is being covered by a design 

modification under an engineering change, RID not approved. 

CS-0Q1 "Operational Program Technical Reviews" schedules for the 

requirements baseline and design baseline for both Flight 1 

and Flight 2 software have been established and published, CLOSED, 

CS-00? "Developmet, Management and Configuration Plans for Software" 
was released in November 197b. CLOSED, 

CX-003 "Controller Checkout Requirements Definition For MPTA". The 
MPTA Program has not requested or provided budgeting for 
Command and Data Simulator or Controller Checkout Console 
equipment to permit checkout of the Controller. Therefore, 
additional procedures beyond those developed for the Orbiter 
checkout have not been developed. CLOSED. 

CS-004 "Software Test Requirements" documentation has been established 
and a schedule set up for implementation. CLOSED. 



TO ENGINE 

PNEUMATIC PACKAGE 



ACCUMULATOR ASSEMBLY 













77.5:1 NOZZLE JACKET REDESIGN 
PIRN 0034 THERMAL ENVIROMENT 



I 



* 

o 

X 

H 

8 

Z 


CD 

5 


186 




FLIGHT THERMAL INSULATION 



hatband 



FMfilHF/CONTROUER/SOFIWARE UTILIZATION PLAN 



SI-8 













SS ME MAJOR MILESTONES 








KU. INTERNAL TANK AND UOLID ROCKET DOUBTER 


A. introduction 

Those two elements of the Shuttle system are used only during 
full operational launch, c.g. , they are the major elements, along 
with the S8MK, that propeil the oyotem into orbit. In each of these 
programs the current effort io on the fabrication of hardware to be 
used in major test programs starting in mid- 1977. Production oi 
flight hardware has also been started in certain areas. 

A reasonably detailed Hazard and rials analyst o has been com- 
pleted tor both of these elements and is being updated and expanded 
as required. In addition hazard analvses have been completed for 
NHTI. tacilities and test operations involving the External Tank, the 
Main Propulsion Test and other associated activities. 

11. External Tank 

External tank hazard analysis are performed in accordance with 
the requirements defined* in NABA NH11 'if 00 ,4 (ID- 1 ) and the procedures 
in Martin's MMC-KT-RAOB . The results of this work is contained in 
the External Tank Catalog of Hazards. The first part of the catalogue 
is structured to provide quick reference to each hazard analysis by 
number, latest revision, date of issue, and hazard description. It 
also reports the actions taken to eliminate or reduce the risks as 
well as the further actions planned. In those cases where a sig- 
nificant risk still exists after all appropriate measures have been 
taken to reduce, and control the hazard are categorized as residual 
Hazards. These are identified and explained in Part II of the catalog. 


1 90 


The number of hazards by subsystem at the time this io written 

looks like thio; 

Structural and Thermal Protection dubnyoteri 22 it emu 

Propul cion and Mechanical U it emu 

Electrical li itema 

< {round Support Equipment 1 t imeo 

There are seven (7) residual hazards noted by the KT prop, rum: 

1. The ultimate load testing oi the dtrueiural Teat Article 
1,11,, Tank and the 10 ft. diameter test tank with liquid hydrop.cn in 
them can euuoe a catastrophic tire it there in a leak lor any reason 
and an ignition source oi any type. Thio test i nr, is to take place at 
MSEC and the means oi containinp, and eontrollinp thio problem are 
mill being worked out. 

2. There are a number oi so-called "single point failure" 
fasteners which could lead to the loss oi the Shuttle vehicle. 
Nineteen (19) such fasteners have been identified and these are 
bcinp, handled independently or all other fasteners and will receive 
100% proof test and mandatory inspections. 

3. Fracture critical welds increase the potential for tank 
rupture durinp proof pressure and load tests. Methods aiv. being 
developed to maintain continuous leak detection to permit test shut- 
down. In addition provisions are buinp, made to contain explosive 
decompression if it does occur. 

4. Allowable leaks at Uh flanp.es may cause mechanical damage 
to the thermal insulation increasing the fire potential due to air 
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liquifaction. Damage to the thermal protection subsystem can lead 
to structural overheating and possible loss of the external tank 
dome. Testing to determine the extent of this type problem will not 
be performed, but seals will receive 100% inspection and so will the 
flange surfaces prior to seal installation. These then will be com- 
pletely leak checked. Another added protective process has been to 
use soft surface coating which seal surface imperfections can impact 
and minimize seal leakage. 

5. External Tank propellants are loaded and off-loaded through 
the Orbiter. In the event of a leak in the tank, or leak, fire, etc. 
in the Orbiter, the lack of an independent External Tank propellant 
drain requires off-loading through the possible hazard zone. This must 
be kept in mind during KSC operations analyses and requires a thorough 
integrated ET/Orbiter risk assessment. 

6. The reactivity of Titanium with Oxygen. Liquid air formation 
could occur at those points near LH 2 lines where insulation is n.ti 
sufficient to preclude it. There appears to be Titanium fittings near 
such points. This hazard is considered closed based on the direction 
given to design to preclude air liquifaction and the remote prob- 
ability of LO^ leaks with sufficient impact possibilities to cause 
ignition. Such spark ignition would require a double failure, i.e., 

an LOX leak accompanied by an electrical failure. 

7. Lightning discharge, either natural or triggered by the 
vehicle, would provide a powerful ignition source for flammable 

materials on the ET. This is considered manageable because of the protection 
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provided by the ground facilities and the existence of an Inflight 
protection system. The inflight system is designed to withstand the 
effects of a direct strike followed by a restrike during flight. Thus 
the penetration of an electrical charge into the compartments of the 
ET are remote. 

The Intertank Structural Test Article status is such that its 
delivery to MS KG is now targeted for March 15, 1977, on schedule. 

The LOX simulator and the Liquid Hydrogen simulator to be used along 
with the STA intertank appear to be supporting the STA schedule. 

Figure XII- 1 shows these components. 

The External Tank Main Propulsion Test Article (MPTA) has had 
some difficulties in fabrication over the past months. The welding problems 
for this assembly (Figures XTT-2,-3') have delayed the fabrication pro- 
cess by 1 1/? months. A major problem is obtaining a "round" tank at 
the welds as well us weld strength with proper safety factors. It 
appears that the tanks are out-of-round after welding and are then 
forced into shape creating an undetermined locked-in stress in the 
weld. More specifically, the status is: 

a . LHo Tank 

The aft dome and aft barrel have been rcwelded with heat 
repairs required to complete the job. The weld inspection which 
followed identified minor mismatch of the two welded assemblies. This 
condition, after due study and evaluation has been accepted for use 
in the MPTA test program. The remaining barrel sections have been 
successfully welded. 


b. LOX Tank 

The LOX dome body and frame Installation was completed 
with the machining of the dome chord, which is the interface with the 
mating flange of the in ter tank. The assembly of the slosh baffles were 
completed * The aft ogive assembly has been welded and inspected and 
hear repairs were required. The forward ogive assembly heat repairs 
have been made and accepted and this component of the LOX tank is 
in process of being welded to the aft ogive. 

A number of actions are being taken to complete the M p TA tank 
sections am* have the entire external tank available in time to 
support the friPTA test schedule by such means as selected Sunday work. There 
will be a continued in-depth review of the operations at each major 
tool prior to first usage to assure proper results and minimize physical 
interferences. 

The External Tank weight at this tima is somewhat over the 
control weight. Inert Control Weight (Level III) is about 73,300 
pounds while the Inert weight (88% calculated, 12% estimated) is about 
73,900 pounds. If you add to this the new weight from changes (about 
500 pounds) and the normal expected weight growth over the next year 
there is a weight problem to be resolved. 

There are many differences between the flight tanks and the 
MFl'A tost tanks. Most of these are to support the special test pro- 
gram requirements such as ground safety requirements. Examples of 
those differences are: 

1. In the vent/relief system an auxiliary common vent mani- 
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fold has been added on the LOX tank for MPTA along with an auxiliary 
valve and line In the Liquid Hydrogen tank. 

2. Additional Intertank access door panels have been 
added to the MPTA. 

3. An auxiliary propulsion drain haa been added In the 
MPTA manhole covers on both tanks. 

4. The tumble system Is not on the MPTA unit. 

5. There is to be special instrumentation on MPTA. 

A major area of concern on the TPS from an operational stand- 
point is the insulation material properties when heated or subjected 
to LOX and water environments. The differences between the MPTA and 
the flight types : 

TPS Location MPTA-Material ET-1. Material 

LOX Tank BX 250 CPR 488 

Intertank BX 250 CPR 488 

LH 2 Tank CPR 488 CPR 488 

Ablator Components 21 square feet of 1630 square feet of 

BX 250 CPR 488 

The choice of a material to provide external insulation on the 
tank has been a complex and difficult one because of the demanding 
thermal requirements as well as the requirements for producibllity. 

This evaluative process continues and thus the types of insulation 
noted above for the MPTA and the ET-1 (flight) units may change in 
the future. At the time this is written: 

1. BX-250 is now being tested for material characterization. 
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2. C p R 488 was selected over the CPR 421 material for use on the 
LOX tak for ET-1 because of its better toxic outgassing properties. 

3. The development of light weight ice protection designs for 
many local protuberances on the External Tank continue to be a 
major design concern. The original approach left some areas suscept- 
ible to icing. Some of the ice prevention and reduction techniques 
under consideration are shown in Figures XXI-4 and -5. 

4. The development of alternate insulated wire designs for 
use in the LOX tank ullage zone is continuing. This wiring is 
expected to be subjected to an environment of temperatures up to 
500°F and pressures up to 44 psia. A number of alterations have 
been investigated and a decision on this area should be forthcoming 
within a short time. 

C. Solid Rocket Booster (SRB} 

NASA has selected the United b'^ace Boosters, Inc. (USBI) of 
Sunnyvale, California, a subsidiary of United Technology Corporation, 
as the assembly contractor for the Space Shuttle Solid Rocket Booster. 
The scope of work covers all the necessary activities at MSFC and KSC. 
This is the last major contract on the SRB, and thus takes MSFC out 
of the direct role of SRB integrator and assembler which has been 
their role up to now. However, MSFC still retains some integration 
responsibilities through the DDT&E flights. Basically, though, they 
will now manage the SRB elements as they have been doing on the SSME 
and ET portions of the program. 
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The following observations are based on Panel fact-finding and 
the SRB Critical Design Review conducted December 8, 1976 at MSFC. 

The SRB CDR was well organized and the work leading up to the CDR 
Board meeting appeared to be quite thorough. The total number of 
Review Item Discrepancy's (RID's) received were 799 ofwhich 614 were 

approved for action of some type. 

A number of items such as these were to be completed in early 

1977: 

1. A study to evaluate the acoustic emission and x-ray fluor- 
escent techniques is planned during the DDT&E phase to determine the 
propellant burn rates of the SRM. 

2. Transducers have been one of the most replaced components 

on past NASA programs and the requirment for redundant and must be in- 
spected and leak checked where possible. 

3. There appears to be a thermal environment problem with the 
SRM nozzle outer boot in terms of protecting the flexible seal and 
the flexible seal to fixed housing joint. Studies of this are being 
accomplished by NASA and the contractor. 

4. Plans should be baselined shortly for integrated testing 
of the SRM flexible bearing and the SRB Thrust Vector Control system 
at Thiokol a9 well as for the development firing of SRM's. 

Based on the Task Team visit, the Wasatch Division of Thiokol 
Corporation appears to be staffed by experience, motivated and 
creative personnel at all levels. This also is the case for the NASA 
Resident Office located on-site. It was noted that the contractor 
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has given the SRM project "individual status/' something accorded to 
major programs at Thiokol. 

To date over 250,000,000 pounds of the propellant used in the 
SKM has been produced for Minuteman Missile motors and others. The 
changes in the formulation are in the quantity of iron oxide used to 
control the burning rate. Minuteman used no iron oxide and the Poseidon 
uses 0.4%, while the Shuttle SRM uses 0.07%. The higher the percentage 
of iron oxides the higher the burning rate in terms of pounds per 
minute. The prop? 1 lant is not adversely affected by its storage or 
aging. Thiokol had some 40,000 pounds held in storage for over 13 
years and it met all specifications when used. There is, then, an 
extensive experience base as well as fully characterized materials 
and processes. 

Batch mixing is used to produce the propellant since the so-called 
"continuous mixing process" has never worked out. Six hundred gallon 
batches (7000 pounds) are mixed at a time in each of three mixers so 
that there can be continuous pouring of the SRM segments. This is the 
equivalent of truely continuous casting. 

The antioxidant currently used in the SRM polymer is PBNA supplied 
by Goodrich Chemical Company. Unfortunately they have ceased produc- 
tion so the following alternatives are being investigated, ttodify the 
manufacturing process at Goodrich and the American Synthetic Rubber 
Company so that they would resume production; find and qualify a new 
source; or find and qualify a new antioxidant. Thiokol has prepared 
a plan to qualify an alternate material to replace PBNA by June 1977. 
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There is sufficient polymer for DM-1 and 2 already on hand and the 
polymer for DM-3 is on hand but not yet processed by American Synthetic 
Rubber. The SRM is expected to operate as required from the point of 
view of thrust capability. The calculated and specified time-thrust 
curves are shown in Figure XII-6. 

The work of the SRB Fracture Control Board continues to assure 
that attention is focused on minimizing any detrimental effects of 
stress corrosion and material fractures from material imperfections. 
Some of the interesting material developed through this board include: 

1. Fracture Control Plans for the case, nozzle and ignition 
system are in the process of review for publication. 

2. The SRB Thrust Vector Control Hydraulic Reservoir contains 
approximately 35 gallons of fluid at 3,000 psi on the high side and 
approximately 60 psi on the low side. The factors of safety are 1.5 
on proof and 2.5 on burst for both operating pressures. The reservoir 
is being supplied by Arkwin, who also supplies the Orbiter reservoir. 
The first development unit was completed in November 1976. All pres- 
sure vessels are under "fracture control'.' The remaining question is 
whether there is a fracture control plan and a requirement for support- 
ing analysis and test? 

3. Problems exist with the making of thick butt welds which 
has triggered an examination of this area and the methods to be used 
to eliminate unacceptable weldments. 
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D. Information Update 


1. Solid Rocket Booster 

As with any rapidly moving program the status of accomplish- 
ments and concerns also changes. The material contained here pro- 
vides more specifics on items already discussed as well as items 
not previously covered. 

Key milestones to look forward to in this SRB Project 
include the following: 

a. The first development firing test of an SRM is 
scheduled for the June 1977 period, 

b. The so-called "Allup " Electrical & Instrumentation Verification 
Test" (EIVT) is scheduled for sometime in the March 1977 period, 

c. An important sub-system delivery Integrated Electronics 
Assembly (IEA) is scheduled for March which will be a part of the 
EIVT, 

d. Prototype parachutes for the recovery sub-system scheduled 
for April, and 

e. The next months should see a great deal of activity in 
qualification testing of components for this project. 

An examination of the project, e.g., the Critical Design Review 
and Quarterly Reviews indicate that the Solid Rocket Booster is 
progressing very well and that the concerns and problems are being 
resolved in an orderly and comprehensive manner. Special efforts 
are being made in the following areas which are considered as some- 


what troublesome: 


a. Project Integration 

1. Ascent thermal environment and its impact on the 
SRB design and performance. 

2. The thermal c irtain protection for the SRB aft 
end regarding curtain overpressure and flutter. 

3. Qualification of SRB Range Safety components to 
vibration levels experienced by the External Tank. 

b. Thrust Vector Controls rely on the APU which has 

been experiencing fuel pump performance degradation. The actuators 
have been reviewed to assure that the design is adequate and there 
is some consideration being given to the modification of the seals. 

c. Major Ground Tests requires the on-time delivery of the 
support test equipment (STE) for testing structures components and 
the EIVT and SRB/ET separation test articles. 

Solid Rocket Booster lightning protection from direct strikes 
and from indirect effects continues to receive attention. In addition 
to NASA and its major contractors on the SRB project support is being 
received from the Mission Research Corporation and the Lightning 
Transients and Research Institute. Figure XII-7 represents possible 
entry points and paths for lightning strikes on the Shuttle System. 

The direct effects, that is the burning, blasting and direct coupling 
of voltages caused by lightning arc attachment, include SRM case 
burnthrough, range safety antenna damage, thermal protection system 
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damage, frustum separation ordnance initiation, current path off 
the SRB to other elements and to the atmosphere. Actions are being 
taken in all of these cases including tests, analysis and combined 
investigations. The indirect ef.’k.cta, that is the damage or malfunctions 
due to currents and voltages caused by electromagnetic fields 
associated with the lightning, are being examined to determine the 
threat level (threshold value at which damage or malfunction can occur), 
the circuit susceptibility to the threat level and what should be done to 
design for achievement of threat levels below the susceptibility values. 
Analysis, tests and investigations are in progress to determine the 
threat levels and means of preventing damage by shielding. These 
resolutions should be reached by mid-3ummer 1977. 

The latest Thermal Protection Subsystem pattern for the SRB is 
shown in Figure XII-8 which also includes the design limit temperature 
and maximum Heating rates expected in BTtl/f t^-sec. 

The following data updates the Solid Rocket Motor material. 

Among the many significant accomplishments during the past months has 
been the delivery of the first case segment in September, the completed 
nozzle bearing test on a prototype system, the delivery of all the 
development motor (DM-1) case segments by November 1976 and the DM-1 
is now in the manufacturing cycle. The SRM nozzle assembly is a 
major design effort and considered one of the more difficult items 
to achieve the requirement objectives. Figures XII-9, -10 show this 
nozzle in cross-section. The redesign is completed and is more 


conservative using: 

a. carbon cloth phenolic cowl 

b. boot thickened to 2.0 inches of asbestos silica filled NBR 

c. silica ring added under the fixed housing insulation on DM-1 

d. grease added to the boot cavity 

e. additional sensitivity analysis to be conducted 

f. boot instrumentation increased for DM-1. 

The APU Critical Design Review was held at Sundstrand during the 
second week of January 1977 with the most significant problem surfaced 
being the degradation in fufil pump performance due to bearing swelling. 
Various bearing configurations are being evaluated to resolve this 
problem. Information on these type of commonality items shou'M, of 
course, be transmitted to all Shuttle elements affected by the use 


2, External Tank 


The ET contractor la completing their assessment of the 
impact of the vibroacoustic and air-load increases and it woMld 

1 

appear that not only will the main propulsion lines for liquid 
oxygen and liquid hydrogen be affected, but there may be some 
impact on various other structural items within the tanks themselves. 

These environmental conditions (increased temperature and aerodynamic 

pressure or loads) have been under study for some time and the 

Panel intends to follow the results of Impact studies currently underway, 

Wind tunnel testing recently indicates that heating rates 
in the range of 45 BTU/Ft^-sec may exceed the capability of the 
SLA 561 ablator currently assigned to protect protuberances, e.g., 
struts and external fittings. 

The Anti-Geyser system design is receiving additional attention 
to assure that the system can be certified that it meet requirements. 

Two configurations are under evaluation, these are shown in Figure XII-11. 

This may lead to a reduction the complexity and weight of the anti- 
geysering system. 

Non-destructive methods capable of inspecting the installed 
thermal insulation as to its bond- to-sur face integrity is receiving 
continuing attention. The inspection problem on the external tank « 

can also be found on the SRB and the Orbiter. The external tank 

I 

contractor in working with many methods indicates that at this time 
the "sonic impedence" method is most promising. Further development 
and testing will be necessary. 
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XIII. ORBITER THERMAL PROTECTION SUBSYSTEM 


A. Introduction 

TPS will be just flown on the Orbiter 102 although sample and 
simulated materials will be used on the Orbiter 101 as a part of the 
Approach and Landing Tests and the Vibro-acoustic test programs. 

The Orbiter Thermal Protection Subsystem (TPS) has undergone a 
continual, albiet gradual, evolution based on the growing under- 
standing of the aerothermodynamic performance requirements and struc- 
tural qualities of both the Orbiter and the total Shuttle System. As 
ascent/descent trajectories and resultant isotherms and structural 
loads have been refined there has been concommitant changes in the 
TPS with regard to the coverage of surfaces with Reinforced Carbon- 
Carbon (very high temperature protection leading edge material), High 
Temperature Reuseable Insulation and Low Temperature Reuseable Insu- 
lation, and finally the use of Flexible Reuseable Insulation (RCC, 

HRSI, LRSI, FRSI, respectively). There have also been changes in the 
leading edge structural system (LESS) in terms of material thinness 
and type and thickness of internal insulations. Thermal seals are 
used to protect or seal off moveable aerodynamic surfaces, static 
openings, and "open-shut" one-time movement doors from the influx of 
high temperature gases and plasma. These have been undergoing con- 
tinuing investigation, design, test and redesign. In addition to these 
elements, there is the SSME heat shield and the AFT thermal protection 
area on the Orbiter. 

Beyond the design and use of the TPS there is the major job of 
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inspection, repair, supply and installation of all of the component 
parts that make up the total TPS. Each of these areas is receiving 
more and more attention as the design requirements and design imple- 
i mentation matures. 

The Panel continues to monitor the evolution of this area be- 
cause the system is a major advancement in the state-of-the-art and 
is a "must work" component of the Shuttle Program rather than because 
of specific current problems. 

The Panel's review included inspection visits to JSC, Rockwell, 
Lockheed, and Ames Research Center, as well as examination of reports 
and documentation on TPS. 

B. Observations 


The table below shows the current configuration in terms of 
area and weight for each type of coverage. 


TPS Type 

2 

Area, Ft 

Weight, Pounds 

Leading Edge Structural 
Subsystem, LESS (RCC) 

409 

3,113 ' 

HRS I 

4,911 

9,311 

LRSI 

2,857 

2,256 

FRS1 

3,436 

1.099 


TOTAL 11,613 15,779 

In addition to the above items there is the Base Heat Shield at 

2 

the engine or aft end of the Orbiter covering 261 Ft and weighing 
about 355 pounds as well as the thermal barriers and seals which are 
estimated at 1,400 pounds. Thus the total weight of the TPS as we 
see it today is about 17,534 pounds. 


217 


As the Outer Mold Line (OML) of the Orbiter has been defined In 
response to performance requirements, the thickness of the tiles has 
been increased and this has meant an increase in weight of about 1200 
pounds . 

* 

As noted in the section on the External Tank there is a concern 
regarding the effect of ice from the ET impacting the TPS during the 
ascent portion of the mission. The concern is that after prelaunch 
cryogenic loading, ice may accumulate on the external tank. When the 
space shuttle main engines and solid rocket boosters are ignited, the 
resulting vibration may shake off the ice with subsequent damage to 
the Orbiter TPS. The recommended concept would provide ice prevention 
on the forward section beyond tank station 1871 through the use of 
electrical heaters on the Orbiter/ET forward attachment. The Shuttle 
Program Manager directed the contractor, Martin Marietta Corporation, 
to implement the recommended fixes except for component relocation. 

KSC was directed to continue their study to define a method, of making 
a launch decision based on ET icing conditions. 

The following summarizes the TPS data: 

1. The tiles are segregated as: Class I tiles are white- 
surfaced and usually are 8 inches square and Class II tiles are black- 
surfaced and usually measure about 6 inches square. White is the LRSI 
and black is the HRSI. The number of tiles being produced for the » 

program have not been fully determined as yet. Where special close- 
out tiles are required, usually curved or peculiarly shaped ones, the 
Orbiter contractor, Rockwell Intemational/Space Division, will 
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machine and coat the tiles. There may be about 3,800 tiles that fit 
in this category. Lockheed inspection procedures use about 1% of 
the tiles, which is about one inspection per day on production tiles. 
I Total tiles delivered to date are about: Class I (white coating 

called G036B) 980, Class II (gray with old 0005- type coating and the 

i 

newer black coating) 5,000. About five arrays have been used on 

Orbiter 101, i.e. about 192 tiles. Qualification tests will use 

1,702 tiles to be delivered by June 1, 1979. Almost 31,000 tiles 

are to be delivered to Palmdale for the Orbiter 102 between January 

) 

1977 and June 1973. 

2. To get a "feel" for the evolution and resolution of 
problems the status of TPS problems defined in 1974 by the Panel are 
commented upon in Table XIII- 1. 

3. The Orbiter TPS Critical Design Review is scheduled 
for late April 1977, while the Orbiter 102 CDR is scheduled for 
August 1977. An area of interest to the Panel is whether or not the 
Review Item Discrepancies (RID's) in the system relating to the TPS 
are being followed-up to complete and satisfactory closure. 

4. The TPS installation is a major area of interest be- 
cause of the difficulties in obtaining and maintaining tolerances 
during installation and operation as well as the operational diffi- 

* culties caused out-of-tolerance areas. The tolerances deal with 

« tile-to-tile gap and step tolerances statically and dynamically. 

The maintenance of radii on the tile edges and between surfaces 
affects the radiant energy view factors for heat transfer and 
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associated flow patterns. There is no specification that we know of 
for the thickness of the tile coatings. There is a requirement for 
absorptivity/emissivity ration (optical-thermal properties). In exami- 
nation of random tile samples, it has been determined that the coating 
thickness ranges between 0.011 to 0.015 inches thick (11 to 15 mils). 

5. Current calculations indicate that the HRSI may very 
well be subjected to temperatures between 2800 F, and 2900 F. on the 
first OFT mission. The Ames 20 megawatt 2x9 tunnel can run worth- 
while tests to the required energy levels. This is of interest be- 
cause temperature- time, and heat load rates are critical to defining 
the ability of the HRSI t< stand-up to these temperatures and reuse. 
Major concern would most likely be with the temperatures experienced 
in the gaps between the tiles. 

6. The question of tile repair during the orbit phase of 
a mission has been evaluated and discarded by the program as not a 
viable approach. 

7. Configuration management for the TPS and its tiles 
should be examined to assure that the as-designed, as-built and as- 
tested match. 

8. With tile covering most of the surface, the Panel will 
examine the impact of radio transmissions and EMC effects, if any, 
on the tile coatings. 

Aerothermal seals, payload bay door seals, and static thermal 
barrier penetration locations are shown in Figure XIII-1, 2, 3, 4 
and 5. As noted before, these seals are still in the development 


stage but do offer the required protection. "Life" capability would 
have to be proven as well. 

An example of the LESS-type of assembly is shown in Figure XIII-6 
< which shows the fuselage nose cap assembly wherein the nosecap itself 

is made of RCC material. The mission life predictions analyses have 


shown the following minimum values for this type of nose cap config- 
uration: TEOS«Tetraethylsilicate over coating. 


LOCATION 

PLIES 

T °F 
Max 

ALLOWABLE 

MASS 

LOSS,#/ Ft 

NO. OF MISSIONS 
2 Baseline Baseline 
Coating Coating+TEOS 

Exterior Stagnation Point 

19 

2489 

0.03 

31 

Exceeds 100 

Chord Line, Exterior 

19 

2270 

0.03 

29 

Exceeds 100 

Windward Nosecap Lug 

38 

1028 

0.05 

11 

67 

Windward T-Seal Lug 

19 

1028 

0.05 

6 

50 

Windward Expansion Seal Lug 

28 

857 

0.05 

47 

Exceeds 100 


The items that would appear to not meet the 100 mission life requirement 
are being modified to meet the 100 mission life. A fiberglass nose cap 
simulation has been installed on the Orbiter 101. 

The first mission in the Orbital Flight Test program (OFT) with 
Orbiter 102 is designed to assure mission safety by trajectory shaping 
to minimize the total heat load and keep the structural bonding temp- 
erature within the single mission capability of the TPS. This is 
accomplished by accommodating trajectory dispersions, early boundary 
layer transition and the performance uncertainties of the TPS itself. 
Such trajectory characteristics between TPS design and the expected 
first OFT: 
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PARAMETER 

TPS DESIGN 

OFT #1 

Cross Range, NM 

1,085 

682 

Down Range, NM 

4,300 

2,593 

^REF BTU/Ft 2 -Sec 

79 

90 

^REF BTU/Ft 2 

62,520 

40,219 


* 

* 
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C. Information Update 

The Orbiter TPS entry heat load sensitivity has been examined 
to determine the effect of design and expected flight trajectories 
including dispersions from nominal values. The TPS, as noted, is 
designed to mission 3B (this is trajectory 14414.1) using nominal 
characteristics for material and aerothermodynamic factors. The 
peak structural temperatures are not to exceed 350°F and the peak 
strain isolation pad (SIP) outer bondline temperatures are not to 
exceed 500°F . 

The actual entry trajectory is affected by such things as: 

- Aerodynamics 

- Density and winds in the atmosphere 

- Guidance and Navigation parameters (velocity, angle of the 
Orbiter in attack and bank, rate of descent, etc.) 

The nominal values associated with the design and aerothermodynamic 
factors can vary during actual flight due to such things as the 
laminar- to- turbulent flow transition time and location, the heat 
transfer and fluid property dispersions, tile and SIP material properties 
which are determined on samples such that the actual conductivity, 
density and specific heats will vary. 

The sensitivity analyses indicate that the total heat load 
decreases with reduced down-range distance and consequently a lower 
bondline temperature. Some of the parameters that were varied included 
the surface roughness (17 mil used in the design and 30 mil used at 
the roughness trip criteria, orbit inclination (from 38° to 55°) with 
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launch from ETR, angle of attack of 30/40 degrees. As a result, 
there appears to be adequate bondline temperature margin for 0FT#1 
with trajectory dispersions analyzed and even with early transition 
from laminar to turbulent flow. Further work will be done between 
now and August of 1978 to assure the integrity of current analyses. 

Wing-elevon aerothermal seal studies are continuing to examine additional 
add to the confidence that the baseline design 
w? -s to /meet all the design requirements, e.g. , 

1. Maintain the structure below 350°F 

2. Withstand acoustic environment of 163 db in ascent for 
8.5 minutes for 100 missions 

3. Withstand a pressure differential of + 3 psi 

4. Accommodate thermal/structural deflections and a seal environ- 
ment of -150°F to +275°^. 

The program feels that the present "blade and tube" design baseline 
seal system fulfills the requirements. 


0 
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table xi it- i STATUS OF TPS PROBLEMS DEFINED JULY 1974 
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FIGURE XIII-1 AEROTHERMAL SEALS, PAYLOAD BAY DOOR SEALS, AND 
STATIC THERMAL BARRIER PENETRATION LOCATIONS, _ 
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FIGURE XIII- 2 
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figure xin-5 HIGH PRESSURE GRADIENT GAP FILLER 




